Observed Signal · Oct 15, 2026 · Security Research · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
Citizen Lab: Zero-Click Spyware Delivered via Malicious Ads
Researchers at The Citizen Lab, University of Toronto, and ad security firm Confiant have documented the first confirmed case of zero-click spyware being delivered through online advertising infrastructure. Israeli company Discover-Tech allegedly used its own demand-side platform (DSP) and a platform called Controlium to target specific devices by collecting advertising IDs and IP addresses from ad auctions. Malicious code was loaded when a targeted ad rendered, requiring no click. Citizen Lab analyzed nearly four billion bid records, finding attack scripts served in over 75,000 apps and 120,000 websites, including popular apps like Duolingo and Grindr. At least 45 devices at Al Jazeera were targeted in 2024-2025, with Windows systems confirmed compromised by spyware from Candiru or Bindecy. In response, Google, Beeswax, Liftoff, and Eskimi removed or suspended Discover-Tech, and IAB Europe suspended it from its Global Vendor List for TCF violations.
This is the first confirmed case of government-backed zero-click spyware being delivered through online ads, posing a significant threat to the adtech ecosystem's security and trust.
Track Confiant Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Citizen Lab and Confiant documented the first known abuse of ad tech for zero-click spyware delivery.
- Discover-Tech, an Israeli company, used its own DSP and Controlium platform to target devices via advertising IDs and IP addresses.
- Citizen Lab analyzed nearly 4 billion bid records; attack scripts were served in over 75,000 apps and 120,000 websites between March and June 2026.
- At least 45 devices at Al Jazeera were targeted in 2024-2025, with confirmed Candiru or Bindecy spyware infections on Windows systems.
- Google, Beeswax, Liftoff, and Eskimi removed or suspended Discover-Tech; IAB Europe suspended it from the Global Vendor List.
Connected Companies & Entities
6 Entities mapped“Security researchers with ad quality platform Confiant, which worked with Citizen Lab to investigate...”
“Google revoked Discover-Tech's access to its ad exchange platforms.”
“Beeswax removed Discover-Tech, according to the article.”
“IAB Europe suspended Discover-Tech from its Global Vendor List after an audit found TCF violations.”
“Eskimi blocked Discover-Tech's accounts and domains.”
“Liftoff paused Discover-Tech's access.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Phone and App Features to Defend Against Spyware
Targeted spyware attacks — including zero-click exploits used against journalists and civil‑society members — have become common. Major platform owners now offer opt‑in defenses to reduce the risk of these stealthy hacks: Apple’s Lockdown Mode, Google’s Advanced Protection Program (and Android’s Advanced Protection Mode), and WhatsApp’s Strict Account Settings. These features trade some convenience for stronger protections (blocking certain message attachments, restricting links, tightening app install policies, blocking legacy networks, requiring security keys, enabling intrusion logging, etc.). Security researchers and publishers recommend enabling these controls if you are at risk from government‑grade surveillance. While not foolproof, evidence and forensic analyses indicate these measures have helped stop or limit successful spyware compromises in real cases.
Auszeit App Delays Social Media with 15-Second Pause
Karl Maier, an Austrian management consultant, has developed the app 'Auszeit' to combat compulsive social media use. Available since October for iOS and Android, the app inserts a 15-second countdown before opening selected apps like Instagram, TikTok, or Netflix during set time windows. The free version covers two apps, while a paid 'Auszeit Plus' subscription (€9.99/year) offers more apps, longer countdowns, and full blocking. The app is privacy-focused: no account, no server, no analytics, all data stays on-device. Maier launched the app through his company nxtChange Consulting FlexCo in Graz. Competitors include Apple Screen Time, Google Digital Wellbeing, Opal, ScreenZen, and the German app 'one sec'. A 2023 PNAS study cited in the article showed that one sec reduced app usage by 57%.
ChatGPT Reaches 20% of Google's Search Volume
OpenAI reports that ChatGPT now accounts for about 20% of Google's search volume, according to Adam Fry, ChatGPT Consumer Product Lead. This figure is based on OpenAI's internal analysis comparing search queries on ChatGPT to Google's. Fry clarified that not all prompts count as searches; only those that trigger a web search are considered. The growth reflects ChatGPT's rapid adoption, with over 1.2 billion weekly active users. While Google still dominates the search market with over five trillion annual queries, AI chatbots like ChatGPT are increasingly competing with traditional search engines. This shift has implications for advertising, as both OpenAI and Google expand AI-based ad offerings (ChatGPT Ads and AI Mode Ads).
Receive all future signals for Confiant & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.