Israeli ad firm Discover-Tech used online ad auctions to target at least 45 devices with Candiru spyware, no click needed.

The University of Toronto researchers say it is the first public technical proof of so-called zero-click spyware arriving through ads, in which victims did not have to tap or click anything.

The report ties at least 45 Al Jazeera devices, targeted in 2024 and 2025, to Candiru. Citizen Lab first exposed the Israeli spyware maker, now known as Integrity Labs, in 2021, the same year the US blacklisted it.

The ads themselves came from Discover-Tech, an Israeli company that presents itself as an advertising firm. In practice, Citizen Lab says, it acts as a go-between for several spyware vendors, Candiru among them.

The method relies on real-time bidding, the split-second auctions that decide which ad a person sees when a page or app loads.

Each time a Discover-Tech ad appeared, a script checked the device’s ad ID and IP address. A device on the target list received code that started the attack, while every other device got back nothing at all.

That meant nobody had to click, and also meant the ad companies serving the ads never saw the harmful code.

The operation was large, too, and after reviewing nearly four billion ad-bidding records, the researchers found Discover-Tech ads in more than 70,000 apps and 120,000 websites between March and June 2026.

Some of those ads landed on government and defence networks, including NATO’s. Confiant, an ad security firm that ran its own investigation, also spotted them at the US Department of Defense and the International Atomic Energy Agency.