Researchers have uncovered the first confirmed cases of sophisticated spyware being delivered through online advertisements without requiring users to click on anything.
At least 45 devices at the international news organization Al Jazeera were targeted in attacks linked to an Israeli advertising company and a commercial spyware developer.
Security experts warn that the technique could expose millions of internet users to surveillance, raising new concerns about the safety of digital advertising.
Internet users have long been warned not to click on suspicious advertisements. But a newly uncovered cybersecurity threat suggests that simply visiting a website or opening an app displaying an advertisement could be enough to compromise a device.
Researchers at the University of Toronto's Citizen Lab have documented what they describe as the first confirmed cases of zero-click mercenary spyware delivered through targeted online advertising.
In a report, the researchers identified a technique they call "AdFection," which allows attackers to infect targeted computers without requiring victims to click a link, download a file or take any other action.
The investigation, conducted with cybersecurity company Confiant, found that an Israeli advertising company called Discover-Tech allegedly used the infrastructure of legitimate digital advertising networks to deliver sophisticated surveillance software.
The findings suggest that technology designed to show consumers advertisements based on their interests and browsing habits can also be exploited to identify, track and potentially hack specific individuals.
Dozens of devices targeted
The researchers identified attacks during 2024 and 2025 involving at least 45 devices at Al Jazeera, the international news organization based in Qatar.
The attacks were linked to spyware developed by Candiru, an Israeli surveillance technology company that has previously been placed on a U.S. government trade blacklist.
According to the investigation, devices first connected to infrastructure operated by Discover-Tech after encountering advertisements. They subsequently communicated with servers associated with Candiru's spyware.
Researchers concluded that the advertising system was being used to deliver malicious software directly to targeted devices.
The investigation also uncovered evidence of surveillance-related advertising activity reaching computers and networks associated with government agencies, international organizations and major technology companies. However, researchers did not establish that all those devices were infected.
How the attacks work
Most online advertising operates through automated auctions. When someone opens a website or app, advertisers compete in fractions of a second to display an advertisement.
Those auctions use information about the consumer, including location, browsing activity and device identifiers, to determine which advertisements to display.
Citizen Lab found that Discover-Tech operated a platform called Controlium, which allegedly allowed surveillance operators to use that same information to identify particular individuals and deliver malicious code.
The process could unfold without the consumer noticing anything unusual.
An advertisement might appear normally, or it might load in the background. The advertisement could then contact a remote server, which would determine whether the device was an intended target.
If it was, the server could return malicious code designed to exploit a software vulnerability and install spyware.
Unlike conventional phishing attacks, the victim would not need to open an attachment or click a suspicious link.
The scale of the operation was considerable. Researchers examined nearly four billion advertising bidding records and found that Discover-Tech advertisements appeared on more than 120,000 websites and 70,000 mobile applications during a four-month period in 2026.
That does not mean every device displaying those advertisements was infected. The researchers said the infrastructure also appeared capable of collecting information about large numbers of users to identify potential surveillance targets.
What spyware can do
Mercenary spyware differs from ordinary advertising trackers and most consumer malware.
It is sophisticated surveillance software typically sold to governments and intelligence organizations, often for substantial sums of money.
Depending on the software and the device's vulnerabilities, an infection may allow an attacker to obtain private messages, emails, files and other sensitive information. Some spyware can also activate microphones or cameras without the owner's knowledge.
The newly documented attacks are particularly concerning because victims may have no indication that their devices have been compromised.
The investigation does not establish that ordinary consumers are being infected on a widespread basis. Such sophisticated attacks have historically concentrated on journalists, political activists, government officials and other high-value targets.
Nevertheless, the findings demonstrate that the advertising infrastructure used by millions of ordinary consumers can be exploited for much more intrusive surveillance.
Advertising companies take action
Following the investigation, several major advertising companies moved to restrict Discover-Tech's activities.
Google terminated the company's access to its advertising exchange platforms and deployed Safe Browsing protections for known malicious domains.
The advertising industry organization IAB Europe removed Discover-Tech from its approved vendor listings. Other advertising companies, including Beeswax, Vungle and Eskimi, also blocked or suspended the company's access.
Discover-Tech and representatives associated with Candiru did not respond to requests for comment reported by WIRED before publication.
How consumers can protect themselves
Although zero-click attacks are difficult to prevent, cybersecurity specialists say consumers can take several precautions to reduce their exposure.
Use a reputable ad blocker. Blocking advertising scripts can reduce opportunities for malicious advertisements to reach a device, although it cannot guarantee protection.
Keep operating systems and browsers updated. Security updates can close vulnerabilities that sophisticated spyware relies on.
Limit advertising tracking. Turn off personalized advertising where possible and periodically reset mobile advertising identifiers.
Be cautious about unfamiliar apps. Download software from trusted sources and review permissions.
Take additional precautions if you're at elevated risk. Journalists, activists and others who may be targeted for surveillance should consider specialized security assistance and stronger device protections.
The larger challenge, researchers say, is that individuals cannot fully protect themselves against attacks that exploit the infrastructure of legitimate advertising networks.
The discovery raises questions about how thoroughly advertising companies screen the businesses that purchase ads and whether current safeguards are adequate to prevent surveillance companies from exploiting those systems.
For consumers, the findings add a troubling new dimension to online privacy: An advertisement does not necessarily have to be clicked — or even noticed — to become a security threat.