An Israeli-developed system has been used to deliver “zero-click” spyware to the phones of journalists and staff at the Al Jazeera news network through online advertisements, according to research released by the University of Toronto’s Citizen Lab and US cybersecurity firm Confiant. The technique, referred to as “AdFection,” exploits the global online advertising ecosystem to infect devices without any user interaction.
The spyware delivery method was reportedly employed in 2024 and 2025, targeting at least 45 devices at Al Jazeera with commercial spyware created by Israeli company Candiru. Data analyzed by researchers indicates that this system may also have facilitated the deployment of spyware from other Israeli firms.
Discover-Tech, an Israeli company established in March 2020 by director and CEO Dekel Boni, developed the underlying technology. The system covertly integrates with the real-time bidding process that determines which ads users see, enabling it to profile and identify targets via pseudonymous information such as location, IP address, and browsing habits. When the system identifies a high-value target, it delivers malicious code hidden within seemingly ordinary advertisements, infecting devices without requiring victims to click or download anything.
Researchers describe Discover-Tech as operating under the guise of a legitimate advertising vendor while acting as an intermediary between ad platforms and spyware groups. The company was previously certified by Google and the Brussels-based Interactive Advertising Bureau (IAB) Europe until this year’s findings prompted both organizations to suspend or block its access pending further inquiries.
Investigations revealed that between March and June 2026, Discover-Tech placed bids for ad space approximately 3.7 billion times, winning 442 million auctions. Its ads were displayed across over 120,000 websites—including major news outlets like the BBC and the New York Times—and more than 70,000 mobile applications, such as Yahoo Mail, Duolingo, and dating apps Badoo and Grindr.
Beyond media employees, the ad campaigns targeted a broad range of individuals, many of whom appear to work in government, law enforcement, or critical infrastructure sectors across Norway, Sweden, and Denmark. Devices affiliated with prominent organizations such as NATO, the European Commission, US defense contractor Raytheon, and semiconductor companies Nvidia, AMD, Sandisk, and Arm were also targeted, raising concerns that profiling and potentially further spyware infections may have occurred more widely.
Bill Marczak, a senior researcher at Citizen Lab, emphasized that Discover-Tech’s use of the advertising ecosystem to deliver spyware represents a new, stealthy method that could be employed by multiple mercenary spyware vendors and urged urgent investigation to understand the full scope. Discover-Tech and Dekel Boni have not responded to requests for comment. Candiru, which was blacklisted by the US government in 2021 following prior allegations of spyware targeting politicians and journalists, also did not respond to inquiries.
Google stated that it removed Discover-Tech from its platforms after the joint investigation revealed policy violations, while IAB Europe said it had suspended the company’s vendor status pending further review. The findings highlight ongoing concerns over how commercial spyware firms exploit legitimate technology infrastructures to conduct covert surveillance across international borders.