{
  "id": 14777743,
  "title": "First-Ever Public Confirmation of 'Zero-Click' Spyware Delivered Via Targeted Ads",
  "url": "https://urgent.news/2026/10/15/first-ever-public-confirmation-of-zero-click-spyware-delivered-via",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T20:00:00.000Z",
  "source": {
    "name": "Slashdot",
    "slug": "slashdot",
    "url": "https://tech.slashdot.org/story/26/10/15/1822259/first-ever-public-confirmation-of-zero-click-spyware-delivered-via-targeted-ads"
  },
  "original_language": "en",
  "account": "Citizen Lab has uncovered the first documented instance of zero-click mercenary spyware being distributed through targeted online advertisements, a method dubbed AdFection. Researcher Bill Marczak stated, \"While there has been much speculation about the potential of online ads to identify and automatically hack targets with precision, this is the first time we have empirical evidence of this process in action.\" The Guardian reported that Citizen Lab, a digital investigations research unit at the University of Toronto, believes dozens of devices at the Qatari broadcaster Al Jazeera were compromised by spyware delivered through ads run by Discover-Tech, a specialized digital advertising agency. Discover-Tech utilizes a software platform called Controlium, which enables its clients to mass-profile and deanonymize internet users, subsequently covertly hacking targets with third-party spyware without the victim's knowledge. The installation of the spyware occurs within seconds and is entirely invisible to the user. The report emphasizes that the online advertising ecosystem is being weaponized on an unprecedented scale to profile and silently infect millions of users. Controlium can extract a user's identity and IP address when they engage with a seemingly innocuous ad, such as one for a digital game or telecom service. If the user has been identified as a target for hacking, the spyware firm can then transmit malicious code containing the spyware to the device. Citizen Lab claims that Discover-Tech has served ads to millions of users worldwide since 2024, including in Yemen, Brazil, Mexico, and the Czech Republic. The full scope of the targeting facilitated by Discover-Tech remains unclear. Citizen Lab's discovery adds to growing evidence that the secretive nature of online advertising arrangements can be exploited for surveillance purposes.",
  "summary": "Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted online ads, a technique it calls \"AdFection.\" \"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}