Hyderabad: An Israel-based digital advertising agency, Discover-Tech, has used its global online advertising system to hack into phones and computers, simply by showing people an ad. According to a Financial Times report, dozens of people were infected, and the victims did not need to click on anything. 

The research comes from the University of Toronto's Citizen Lab and the United States' cybersecurity company Confiant. They named this new technique of hacking "AdFection". They found that the spyware had been used to infect devices belonging to journalists and staff at the Al Jazeera news network. 

Targets included NATO and tech companies

Hundreds of thousands of ads run by Discover-Tech were also aimed at staff at other big organisations, including NATO, the European Commission, NVIDIA, and Arm — the UK-based chip designer.

The report says the Israeli firm built this zero-click spyware, turning the advertising system that handles trillions of online ad deals into a secret surveillance tool. The publication noted that Discover-tech could pick up targets and then hack their devices.

It is worth noting that zero-click spyware is different from most spyware attacks. This is because most spyware attacks rely on tricking people into clicking a bad link or opening an infected file. However, in the case of zero-click spyware, as the name suggests, victims need not click any links, making it really dangerous.

Bill Marczak, a senior researcher at Citizen Lab, said, "Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform."

Google and industry body act

Discover-Tech was listed as a certified ad vendor by Google and by IAB Europe — an industry group based in Brussels. The publication says this lasted until both were shown the findings.

Google told the Financial Times that it had blocked the company from its ad platforms for repeatedly breaking its rules, after a joint probe with Citizen Lab and Confiant. IAN said it had suspended the company from its global vendor list while it investigates further.

Tip of the iceberg

The report mentions that Citizen Lab is among the world's top experts on the misuse of commercial spyware. In 2019, Marczak was part of a team that showed how Israel's NSO Group used WhatsApp to hack the phones of reporters, activists, and political figures. One of those was the fiancée of murdered Saudi journalist Jamal Khashoggi.

The new research says Discover-Tech's platform was used against Al Jazeera journalists and staff in 2024 and 2025. At least 45 devices were infected with spyware made by another Israeli firm, Candiru. Data seen by the researchers suggests spyware from other Israeli firms may also have been delivered this way. 

Marczak said Discover-Tech is "surely just the tip of the iceberg". He said that plugging into the online ad world gives spyware sellers a hidden way to deliver their tools and a steady supply of valuable targets.

Records show Discover-Tech was registered in Israel in March 2020 by its director and chief executive, Dekel Boni. 

The report says it presents itself as a "legitimate" ad company but acts as a "a bridge" between ad vendors and spyware makers. 

The US government blacklisted Candiru in 2021, which came four months after a joint probe by Citizen Lab and Microsoft said it had made spyware called DevilsTongue, used against more than 100 politicians, journalists, and others. 

How the ad system was abused?

Targeted online ads work through automatic auctions known as real-time bidding. Advertisers compete to show an ad to a certain internet user, often in less than a 10th of a second. Ad exchanges, run by firms, such as Google and Yandex, send out bid requests. These carry hidden-name details about the user, such a rough location, IP address and browsing history.

Companies normally use this data to tailor their ads. The report says Discover-Tech's software used the same data to profile users and work out who they really were. It then decided whether to target them. If it did, the device was sent harmful code hidden inside an ordinary-looking advert, which installed the spyware.

Billions of bids

A dataset recovered by Citizen Lab showed that Discover-Tech's bid for ad space 3.7 billion times between March and June 2026. It won 442 million of them. Its ads appeared on more than 120,000 websites, including BBC and New York Times news sites. They also ran on more than 70,000 mobile apps, including Yahoo Mail, Duolingo, Badoo, and Grindr.

Many of the people targeted in that period seemed to work in government, law enforcement or key infrastructure in Norway, Sweden, and Denmark. Ads also reached devices at US defence contractor Raytheon, and at chip firms such as Nvidia, Sandisk, and Arm.

The report mentions that Citizen Lab's researchers said, "At a minimum, Discover-Tech would have used these ads to profile those users." They added that "urgent investigation" is needed to confirm whether any spyware infections took place.