Researchers at the University of Toronto's Citizen Lab say they have the first detailed technical evidence of government spyware infecting devices through targeted online ads, Wired and TechCrunch reported Thursday.

The researchers call the technique "AdFection." Citizen Lab found that 45 devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads in 2024 and 2025, Wired reported. TechCrunch said the attack affected at least 45 Windows computers. Zero-click attacks need no action from the victim.

The ads were issued by the Israeli-founded marketing firm Discover-Tech and spread spyware attributed to the Israeli developer Candiru, the researchers said, according to Wired. TechCrunch reported that a second spyware maker, Bindecy, also used Discover-Tech's platform. Citizen Lab said it was not clear which governments were behind the attacks, TechCrunch reported.

"Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all," senior researcher Bill Marczak told Wired. Another senior researcher, Wolfie Christl, called the risk "a nightmare scenario."

The researchers found billions of ad bidding records exposed on Discover-Tech's website, TechCrunch reported. They showed its ads appeared across tens of thousands of apps and websites between March and June 2026, including on devices used by militaries and governments. It is unclear whether those ads led to infections. Wired said the firm's ad impressions appeared on NATO and United Nations networks.

Google terminated Discover-Tech's registration "for systematically violating our policies," a spokesperson told Wired. IAB Europe, an ad industry body, said it suspended the company from its vendor list, Wired reported. Discover-Tech did not respond to requests for comment, both outlets said.

Marczak urged people at risk to act. "If you might be targeted based on who you are or what you do, it's time to disable ad tracking on your devices or even block ads altogether," he said, TechCrunch reported.

What we know: Citizen Lab tied ad-delivered spyware to Discover-Tech and Candiru.
What we don't: Which governments ran the attacks, and how many devices were infected.