When Ads Become Weapons: The Zero-Click Surveillance Supply Chain

The Ads Were the Payload

An Al Jazeera journalist in Doha opened a news story on their Windows laptop. An advertisement loaded in the corner of the screen. The malware installed itself without a single click. No suspicious link. No dodgy download. Just viewing the ad was enough.

This is not science fiction. It is the finding of Citizen Lab, the Toronto-based research group that published its investigation on October 15, 2026. The story exposes something increasingly invisible in digital infrastructure: the convergence of legitimate advertising technology and predatory surveillance.

The Supply Chain Nobody Checks

At the center of the operation sits Discover-Tech, a Tel Aviv company that provides what sounds like a completely normal service: helping advertisers find the right audiences and bidding for ad space on Google, Microsoft, Yandex, and other platforms. They also offer a service called Controlium.

Controlium is where the architecture breaks down. According to Citizen Lab’s analysis, Controlium allowed spyware companies to use data collected by Discover-Tech from its advertising partners to select targets. Once a target was chosen, malicious advertisements were injected into the websites and apps they visited. The malware spread through legitimate ad networks — the same networks that deliver everything from cookie banners to product recommendations.

Wolfe Kristol, co-author of the report, explained to Forbes that anyone browsing websites with online ads could potentially become a target. “It is difficult to protect yourself from persistent malicious advertisements,” Kristol told Forbes. “Advertising blockers should be considered a standard defensive measure in cybersecurity.”

Who Gets Watched

The investigation focused on Candiru, an Israeli spyware company that Citizen Lab says exploited Discover-Tech’s system. Between 2024 and 2025, Candiru distributed advertisements containing malware that attacked up to 45 Windows computers owned by Al Jazeera employees.

Candiru’s capabilities are extensive. The malware could monitor messages, phone calls, and location data on infected devices. When approached by Forbes, Candiru claimed customers did not know how their spyware was actually being used.

This is not the first time Candiru has drawn scrutiny. In 2021, the company was linked to attacks against the London-based news outlet Middle East Eye. Earlier this year, in January 2025, Candiru was acquired by Integrity Partners, a small US private equity firm.

Neither Discover-Tech nor Candiru responded to Forbes’ requests for comment.

The Ad Network Paradox

The architecture of modern digital advertising is designed to make campaigns efficient at reaching target audiences. That same efficiency is what makes this surveillance possible.

When an advertiser wants to reach journalists covering a particular region, they bid for ad space on websites those journalists visit. The targeting is precise. The reach is global. The infrastructure is shared across every major platform — Google, Microsoft, Yandex.

Controlium essentially allowed spyware operators to hijack this targeting system. Instead of selling products, they sold access to surveillance. The ads were indistinguishable from legitimate ones. The distribution channels were the same. The only difference was the payload hidden inside.

Why This Travels

Zero-click attacks delivered through ad networks are not theoretical. They are happening now, right now, across Asia and beyond. The implications extend well beyond any single company or country.

For journalists, the calculus has changed. You cannot simply avoid clicking on suspicious links. You cannot block specific senders. The attack surface is the entire internet — every website, every app, every ad you see.

Digital security vendors need to reconsider their approach. Traditional defenses focus on known threats, suspicious domains, and malicious downloads. None of these address the fundamental problem: legitimate infrastructure being used for illegitimate purposes.

The Privacy Economy

Citizen Lab’s analysis reveals something increasingly uncomfortable about the digital economy. Data collected by advertising companies from their partners can be used to select targets. Once a target is chosen, malicious content flows through the same channels as everything else.

The architecture of modern surveillance does not require sophisticated hacking. It requires access to the same systems everyone uses. Ad networks, content delivery systems, platform APIs — these are the pipes through which both information and malware flow.

Wolfe Kristol’s recommendation is blunt: use advertising blockers. Treat them as a standard defensive measure in cybersecurity. It is a small suggestion with enormous implications. If protecting yourself requires constantly modifying how you interact with the internet, something has broken.

Who Wins and Who Loses

The winners in this architecture are companies like Candiru and Discover-Tech, which monetize surveillance through legitimate-seeming technology. Integrity Partners, the US private equity firm that acquired Candiru, sees returns on an investment in infrastructure that crosses legal and ethical boundaries.

The losers are journalists, activists, and ordinary citizens whose communications are monitored without their knowledge. They are targeted not because of what they do, but because of where they go online.

The real losers may be the public interest. When investigative journalists cannot trust that their communications are private, the information that holds power accountable becomes harder to produce.

What Happens Next

This story will not stop with one report. The architecture enabling it is built into the fabric of the internet. Every platform that serves advertisements faces the same question: how do you distinguish between legitimate targeting and predatory surveillance?

Regulators will need to examine the data flows within advertising ecosystems. Security researchers will need to develop detection methods for attacks that hide in plain sight. Journalists and newsrooms will need to reconsider their digital hygiene — not as optional best practices, but as essential protections.

Citizen Lab’s investigation is a canary in the cookie banner. The technology exists. The supply chain is operational. The question is whether anyone is doing anything about it.

The ads are the weapon. The infrastructure is the weapon. And the only defense is recognizing that the system itself has been compromised.