Zero-Click Spyware via Online Ads: What the Citizen Lab Findings Mean for Organisations

Researchers at Citizen Lab, the digital investigations unit at the University of Toronto, published findings on 15 October 2026 showing that an Israeli advertising agency, Discover-Tech, has been using its Controlium software to serve online adverts that enable zero-click spyware deployment. The Guardian reported that Citizen Lab believes dozens of devices at Qatari broadcaster Al Jazeera were compromised through this method. Zero-click attacks are particularly significant because they require no action from the target — the device is compromised simply by being shown the advertisement, with no link to click, no file to open and no prompt to accept.

Why this matters for UK organisations

The online advertising ecosystem reaches virtually every internet-connected device as a routine part of normal web browsing. The use of this infrastructure as a delivery mechanism for sophisticated spyware is a meaningful development because it bypasses many of the user-behaviour-based assumptions that underpin conventional security awareness training — there is nothing for a well-trained user to avoid. While the confirmed targets in this research are high-profile media and government figures, the underlying technique is not inherently limited to those groups. Executives, legal and finance teams, board members, and others handling commercially or legally sensitive information represent realistic targets for similar approaches. The commercial advertising delivery model also makes this type of attack harder to detect and attribute than more conventional intrusion methods, since the initial delivery mechanism is indistinguishable from legitimate ad serving.

What to review

Review your mobile device management policies, particularly for individuals in high-risk roles such as executives, legal counsel, finance leads and those handling sensitive negotiations or confidential information. Confirm whether ad-blocking or content filtering controls are deployed on managed mobile devices, and consider whether personal devices used for work purposes are included in your mobile security programme. Ensure that mobile security is treated with the same priority as desktop endpoint security rather than as a secondary concern. For organisations with a formal threat model, consider whether targeted spyware delivery is a relevant risk to include, and review whether your incident response procedures cover mobile device compromise.

Source: The Guardian