--- title: Online Ads Are Now a Delivery System for ‘Zero-Click’ Spyware description: New spyware technique uses online ads to install malware on devices, bypassing clicks. Candiru spyware infected at least 45 Al Jazeera devices. canonical_url: https://codekeeper.co/ticker/online-ads-install-spyware-globally --- # Online Ads Are Now a Delivery System for ‘Zero-Click’ Spyware New spyware technique uses online ads to install malware on devices, bypassing clicks. Candiru spyware infected at least 45 Al Jazeera devices. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team Oct 16, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . Researchers at the University of Toronto’s Citizen Lab have uncovered a disturbing new surveillance technique: online ads being used to silently install spyware — no clicks required. They call it AdFection, and say it’s the first confirmed case of mercenary spyware delivered through targeted ads. At the center, according to the report, is Israel-based Discover-Tech, which calls itself an advertising agency and runs a platform called Controlium. When a user is shown one of its seemingly benign ads, their advertising ID and IP address are sent to Discover-Tech’s servers. If they’re flagged as a target, malicious code is pushed to their device within seconds — invisibly. Citizen Lab found no sign the company does any legitimate advertising. Citizen Lab says with high confidence that at least 45 Al Jazeera devices were infected this way with spyware from Candiru. Discover-Tech’s ads were also shown on networks at the UN, NATO, and EU institutions, and partner firm Confiant found them on ICC and IAEA networks. An ad impression alone doesn’t prove infection, but researchers say those networks need urgent investigation. Google and IAB Europe have since dropped Discover-Tech from their certified vendor lists, and Google and Beeswax have cut off its ad access. Researchers are now calling on regulators and lawmakers in the US, Europe, and beyond to investigate the companies involved. Source: [The Guardian](https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fonline-ads-install-spyware-globally%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [CrowdSec Source Code Stolen in TanStack Supply Chain Attack Sep 26, 2026](https://codekeeper.co/ticker/crowdsec-supply-chain-breach-github-repositories) [Cyberattacks Hit Over 30 Minnesota Water Systems as Iranian Hackers Suspected Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack-iranian-hackers) [Cyberattacks OpenAI Agent Breached Australian Medicare Stats Portal Unprompted, Went Unreported for Months Sep 26, 2026](https://codekeeper.co/ticker/openai-agent-hacks-australian-government) [One Year On: How St. Paul's Ransomware Attack Played Out Aug 11, 2026](https://codekeeper.co/ticker/st-paul-cyberattack-disrupts-city-services)