For millions of Americans, the daily routine of reading the news has become an involuntary act of digital exposure. According to a joint investigation published by the University of Toronto's Citizen Lab and the ad-security firm Confiant, an Israeli advertising technology company called Discover-Tech exploited the automated, blind nature of programmatic advertising to deliver targeted zero-click spyware through ads that appeared on some of the most trusted American media brands—including The New York Times, Fox News, CBS, and the BBC—as well as inside the internal networks of the Pentagon and major U.S. defense contractors.

The campaign, dubbed "AdFection" by researchers, represents the first publicly documented case of mercenary spyware delivered through targeted ad ecosystems. Unlike traditional phishing, which requires a victim to click a malicious link, this method demands zero interaction. The moment a targeted advertisement simply renders on a victim's screen, the device is automatically exploited and redirected to an infection server. There is no warning, no confirmation prompt, and no visible sign that anything has happened at all.

The story is not simply one of a single malicious ad. It is the story of how an entire layer of the modern internet—the programmatic advertising supply chain that funds most free content online—was repurposed into a delivery vehicle for state-grade espionage tools. The attackers did not hack The New York Times or the Pentagon. They bought standard ad slots on legitimate exchanges, and the infrastructure did the rest.

A Certified Vendor With a Hidden Mission

Discover-Tech, founded in 2020 and led by CEO Dekel Boni, did not hack websites. Instead, it built a platform called Controlium and went through standard corporate verification processes to become a certified vendor on major global ad exchanges, including Google Ad Manager, OpenX, and PubMatic, as well as Russia's Yandex. Because the company appeared legitimate—and was, on paper, a normal ad-tech vendor—its custom JavaScript code was permitted to run freely inside the ad slots of premium publishers across more than 120,000 websites and 70,000 mobile apps.

The company's board of directors featured Eric Banoun, described by Haaretz as "one of the pioneers of offensive cyber in Israel." A major stakeholder was linked to Sara Hamou, a central figure who has managed corporate networks for Intellexa, the notorious mercenary spyware cartel. According to researchers, Controlium's primary purpose was not advertising at all—it was a bridge allowing mercenary partners to de-anonymize, fingerprint, and automatically infect users the second an ad loaded.

The investigation also tracked a parallel offensive actor using the same Israeli ad framework, code-named Dark Cartographer, which used Discover-Tech's ads to target and compromise mobile devices globally in a separate campaign. Two other Israeli firms—Bindecy, a vulnerability-research shop connected directly to Discover-Tech, and Intelos, a cyber-surveillance software firm linked by Confiant to Discover-Tech's background infrastructure—rounded out the operation. Bindecy's specialty, finding browser flaws, is precisely the capability required to make an ad "zero-click."

How the Zero-Click Attack Works

The exploit chain relies on the fact that programmatic advertising is designed to execute code automatically, with no user oversight. When a reader visits a site like The New York Times or Fox News, the page requests an ad from an exchange. If Controlium wins the bid, its JavaScript executes instantly in the background before anything visual appears.

• Fingerprinting: The script checks the user's IP address and queries device configuration, operating system, and browser version. Ordinary readers receive a benign ad; users matching a high-value target profile—an internal NATO network, a specific newsroom, a defense contractor—proceed to the next stage.
• The Trigger: For selected targets, the ad script exploits a vulnerability in Chrome's rendering engine—a memory corruption or logic flaw—the millisecond the page opens. No hover, click, or interaction is required.
• Sandbox Escape: The browser exploit forces Chrome to execute shellcode, breaking out of the browser's isolation layer and establishing a silent connection to a command-and-control server.
• The Payload: The server drops Candiru—a powerful mercenary spyware also known as Arwen or DevilsTongue—directly onto the victim's hard drive, granting remote control of passwords, microphones, webcams, keystrokes, and private documents.
• Covering Tracks: Once installed, Candiru runs with system-level privileges, clears system logs to erase traces of the initial ad redirection, and begins exfiltrating encrypted data back to the attackers.

The technical elegance of the attack is also what makes it so dangerous. Because the malicious code rides inside a legitimate ad slot, it inherits the trust of the publisher. The victim's browser is not visiting a suspicious domain; it is loading the same exchange traffic it loads every day. Standard consumer antivirus, which scans installed apps rather than in-memory browser execution, is blind to it.

American Newsrooms and the Pentagon in the Crosshairs

The primary confirmed infection target was the Qatari news network Al Jazeera, where at least 45 journalists' devices were compromised. The Qatari broadcaster's technology team discovered Trojan malware on journalist devices that recorded keystrokes, took screenshots, and exfiltrated data. But Confiant's tracking data revealed that Discover-Tech's malicious ad infrastructure successfully executed inside national-security-sensitive internal networks globally—including those of the U.S. Department of Defense (the Pentagon), NATO, the United Nations' IAEA, and the International Criminal Court.

The ads also ran on American defense contractors including Raytheon, Nvidia, Arm, and SanDisk, as well as popular apps such as Yahoo Mail, Duolingo, AccuWeather, Viber, Truecaller, Grindr, and Badoo. Major news outlets where the ad code was delivered included The New York Times, BBC, Fox News, CBC, and Haaretz. Seeing a Discover-Tech ad on one of these sites does not mean the site itself was hacked. Instead, the attackers bought standard ad slots on legitimate programmatic exchanges, allowing the browser to fetch the bad code seamlessly alongside the site's content.

Security analysts draw a critical distinction between profiling and infection. On American networks, the code performed profiling and "identity vacuuming"—harvesting device blueprints, IP addresses, and digital fingerprints—rather than deploying the active spyware payload, which was reserved for select high-value targets to avoid burning expensive exploits and to keep the code hidden from U.S. cyber-defense agencies. Separately, the Pentagon has acknowledged that U.S. forces deployed to active war zones had been tracked and targeted by ad-tech companies harvesting location and device data, prompting several military branches to disable ad-tracking privileges on personnel devices.

An Ally's Private Sector, a U.S. Blacklist

The revelations complicate the narrative of U.S.-Israel intelligence cooperation. While Washington and Jerusalem share deep state-to-state cyber defense through channels like the NSA and Israel's Unit 8200, the U.S. government has treated these private firms as hostile actors. The Commerce Department blacklisted Candiru alongside NSO Group, barring American companies from doing business with them because their tools were deemed a threat to national security and human rights. A White House executive order bans federal agencies from using commercial spyware that poses a national security risk. The Pentagon has also raised Israel's counterintelligence threat level to "critical."

The irony is sharp: a close ally's private sector built and sold the tools that were used to sweep up data inside the Pentagon's own networks. In the realm of advanced cyber-warfare, the old geopolitical definitions of "ally" and "enemy" blur. When private corporations can weaponize everyday digital ads to invisibly infiltrate the world's most secure networks, even the closest international friendships cannot prevent a high-stakes digital standoff.

The Corporate Response and the Limits of Defense

Following disclosure of the report, Google and IAB Europe blacklisted Discover-Tech, removing the firm from global vendor lists and blocking its access to ad platforms. Comcast's advertising subsidiary Beeswax also purged the company from its network. Google had collaborated with researchers during the investigation and moved quickly once the findings were confirmed.

Security experts warn that because these attacks happen invisibly in the background of normal web-browsing traffic, standard consumer defense is incredibly difficult. Robust network-level ad-blocking, browser isolation, and Apple's Lockdown Mode—which blocks complex web technologies and programmatic ad properties—are among the few viable mitigations. For high-risk individuals, forensic tools like the Mobile Verification Toolkit (MVT) can scan device backups for known indicators of compromise, but only if someone already suspects they were targeted.

For the ordinary American reader, the lesson is unsettling: the ad slot beside the headline is an execution environment, and no click is required to enter it. The firms that built this pipeline are now blacklisted, but the model they proved—legitimate ad infrastructure as a delivery vehicle for state-grade spyware—remains a blueprint. The browser tab you closed this morning may have been the quietest intelligence operation you will never know you participated in.