Myth vs Reality: Can Ordinary Online Ads Deliver Government Spyware With No Click?
Citizen Lab and Confiant say Candiru infections at Al Jazeera arrived through Discover-Tech ads that ran the moment they loaded. Here is what the research actually showed—and what it did not.
Security teams have warned for years that the ad ecosystem could carry more than coupons. This week researchers said they finally have live, technical proof that mercenary spyware rode ordinary ads into real devices.
This myth-vs-reality briefing is based on The Hacker News summary of the Citizen Lab findings, with supporting detail from The Record and CyberScoop’s AdFection coverage.
Myth: You have to click a bad ad to get infected
Reality: Citizen Lab says the attack code ran when the ad loaded—sometimes even when the ad loaded in the background, out of sight. No click was required. That is why researchers call it a zero-click path.
Myth: The malicious payload has to ride inside the ad creative the networks can scan
Reality: Discover-Tech, an Israeli firm presenting itself as a normal digital advertising company, placed ads that sent a device’s advertising ID and IP address back to Discover-Tech. Only if the device matched a target did the server return attack code. Because the ad itself carried no attack payload, ad networks had little harmful content to catch. After the findings, Google and IAB Europe removed Discover-Tech from vendor lists; Google told Reuters it acted for systematic policy violations.
Myth: This was only a theory from leaked documents
Reality: Citizen Lab calls this the first public, technical confirmation that mercenary spyware reached real devices through targeted ads. At Al Jazeera, at least 45 devices were targeted in 2024 and 2025, linked to Candiru with high confidence after researchers recovered a Windows sample that matched Candiru techniques from a 2021 analysis. The researchers recovered the spyware from one device but not the browser/app exploit that installed it; that first step is inferred from how the attack chain was set up.
Myth: Only newsrooms were in range
Reality: Discover-Tech’s reach was much wider. Citizen Lab cites nearly four billion ad bids between March and June 2026 on one platform, with callback ads appearing in about 75,000 phone apps and 120,000 websites. Confiant estimated roughly 10 million ads a day. Ads showed up on networks tied to NATO, the UN, EU bodies, government offices, chipmakers, and news organizations. An ad on a network is not proof of infection—only of reach. Confiant found the small set of ads it could tie directly to Candiru were low-volume and mostly hit home and mobile connections.
Myth: Candiru is an obscure name with no prior flags
Reality: The United States blacklisted Candiru in 2021 over spyware used against officials, journalists, and activists. In 2025 its assets were reported bought by U.S. firm Integrity Partners and moved into a new entity reported as Integrity Labs that the sanctions do not cover. Discover-Tech, Candiru’s owners, Al Jazeera, and Yandex did not respond to Reuters, according to The Hacker News.
What this means for your company
Most small businesses will never be a Candiru target. The useful lesson is still practical: staff phones and laptops browse the same open web as everyone else, and “it was only an ad” is no longer a reason to ignore odd behavior after a browsing session. Keep browsers and mobile OS updates current, prefer managed devices for email and files that matter, and treat unexpected microphone, camera, or account-lock alerts as incidents worth a quick look. If you run internal sites that monetize with third-party ads, ask your ad partners how they vet demand-side vendors—Citizen Lab’s closing point is that ad vendors need stronger screening across the supply chain.
Need help hardening staff devices and browsers against drive-by and zero-click style risks? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
