Can an Online Ad Install Spyware Without a Click? The AdFection Investigation Explained

Yes. Security researchers have confirmed that sophisticated spyware was installed through ordinary online advertisements without the victim clicking an ad, opening an attachment, or knowingly downloading anything.

In an October 15, 2026 investigation, the University of Toronto's Citizen Lab documented how an Israeli advertising company, Discover-Tech, enabled the delivery of spyware associated with another Israeli company, Candiru, through mainstream advertising systems. The researchers call this method AdFection.

The clearest confirmed victims were at Al Jazeera. At least 45 devices were targeted during attacks in 2024 and 2025, and investigators established that successful infections occurred. Network records connected the sequence from an advertising impression to Candiru's servers, and investigators recovered a Windows spyware component from a compromised device.

The investigation also uncovered a much larger operation: billions of advertising bids, ads appearing across nearly 200,000 distinct websites and mobile apps, and millions of devices contacting profiling or surveillance infrastructure. A separate investigation identified unusual advertising activity directed at Starlink users.

But one distinction is essential: millions of devices exposed to surveillance-related advertising does not mean millions of phones were infected. Nor does the evidence establish that spyware is probably on the average person's phone, or identify who commissioned the Al Jazeera attacks.

The confirmed facts are serious enough. The digital advertising market was not merely collecting information about potential customers. Its machinery was used to find people, profile them, and, in selected cases, hack their devices.

What was actually confirmed?

The primary technical evidence comes from Citizen Lab's AdFection investigation and a coordinated, independent investigation by advertising-security firm Confiant.

How can a website ad infect a phone or computer without a click?

Most people think of an online advertisement as a picture or video. Modern advertising is more complicated. Ads can load scripts, collect information, and communicate with servers as soon as they appear inside a browser or app.

The process often starts with real-time bidding (RTB), an automated auction that decides which advertisement appears in a particular slot. Advertising intermediaries exchange information that can include IP addresses, mobile advertising identifiers, device characteristics, approximate location, and details about the website or app. An advertiser may use that information to decide whether a particular visitor is worth bidding on.

Discover-Tech exploited both sides of that system: the ability to identify particular devices and the ability to deliver code to them.

The AdFection attack, step by step

1. A person opens a normal website or app. The page requests an advertisement, often without the visitor noticing that an auction is taking place.
2. Advertising platforms expose information about the device to bidders. Discover-Tech's advertising infrastructure can use identifiers and other signals to recognize a potential target.
3. Discover-Tech wins the ad placement. The displayed ad may look entirely ordinary. Citizen Lab encountered examples while visiting mainstream websites and using an Android Sudoku app.
4. The ad contacts Discover-Tech's server. A hidden script sends identifiers and other information to a system researchers analyzed as part of Discover-Tech's Controlium platform. An associated server, called NOAS, decides whether to return additional code.
5. Most visitors receive no attack code. For someone not selected for hacking, the server can return an empty response. Device profiling can still occur.
6. A selected device may receive an exploit. The returned code can connect the device to the spyware operator's infrastructure. If the exploit succeeds, spyware is installed and can communicate with a command-and-control server.

The victim does not need to press the advertisement. The malicious sequence can begin when the ad is rendered, including when it loads in the background.

An ad loading is not the same as a device being hacked. A successful infection requires a vulnerability or an exploit chain that defeats the device's defenses. Browsers and mobile operating systems have security barriers; AdFection shows that sufficiently capable attackers can sometimes get past them. It does not show that any ordinary ad can take over any fully updated phone.

Citizen Lab's reconstruction of the Controlium interface and NOAS delivery system helps explain why the operation was difficult for advertising platforms to detect. The visible ad did not need to contain the final spyware payload. That code could be withheld from automated scanners and delivered only to a chosen target.

What happened to Al Jazeera?

The Al Jazeera attacks are the decisive part of the investigation because they move the story beyond suspicious advertising patterns to forensic evidence of actual compromise.

According to Citizen Lab, at least 45 devices within the news organization were targeted across 2024 and 2025. Al Jazeera supplied network logs from the attack period. Researchers identified a recurring sequence:

Discover-Tech ad infrastructure -> Candiru validation server -> Candiru command-and-control server.

The first connection indicated that an ad had loaded. The next involved a server used to check the device. On infected devices, the sequence progressed to command-and-control communications. Investigators also examined a Windows DLL recovered from one compromised machine and identified distinctive characteristics matching earlier Candiru malware.

That combination matters. A suspicious advertisement alone would not prove an infection. Neither would an unexplained network connection. Network chronology, matching server infrastructure, and recovered malware together support Citizen Lab's high-confidence attribution of the infection chain to Candiru.

In an October 15 statement reported by Al Jazeera, the network condemned attacks on its personnel and called for accountability.

Were 45 phones definitely infected?

That is not what the primary technical report establishes. It says at least 45 devices were targeted and confirms that infections occurred. It does not publish a verified count of 45 infected smartphones. The recovered component described in the report was from a Windows device.

Some news coverage used broader language about dozens of compromised devices. For purposes of a precise account, the original forensic report is the stronger basis for the number. This distinction prevents an observed targeting count from becoming an invented count of infected phones.

What could Candiru spyware do?

Candiru is not an ordinary advertising tracker. In 2021, Microsoft identified Candiru-linked malware it called DevilsTongue, documenting sophisticated Windows exploitation and post-compromise surveillance capabilities. A sufficiently successful spyware implant can potentially collect sensitive communications, files, and other device information, depending on its version and permissions.

That does not prove that every AdFection target had their camera or microphone activated. The public findings do not establish a universal list of actions taken on every infected machine.

How large was Discover-Tech's advertising operation?

Citizen Lab found publicly exposed advertising-bidding records associated with Discover-Tech's MyDSP platform. The records covered March through June 2026 and exposed a scale far beyond the handful of infections that could be investigated forensically.

These are Citizen Lab's figures, drawn from different parts of the investigation. They are not all measuring the same thing and should never be added together.

The underlying dataset was incomplete. It did not capture every advertising platform that Discover-Tech used, and an ad impression does not establish that the device was personally selected for hacking. Citizen Lab also found ads reaching networks associated with governments, militaries, media companies, international institutions, and critical infrastructure. That demonstrates exposure in sensitive environments, not confirmed compromise of every organization whose network appeared in the data.

One other finding is revealing. The exposed MyDSP records suggested approximately $109,000 in advertising expenditure during those four months, while recorded conversions were consistently zero and ordinary advertiser revenue was largely absent. The researchers found no good evidence of a conventional advertising business in that dataset. The fields could have been incomplete, so the accounting records are not proof by themselves. Combined with the surveillance tools and delivery behavior, however, they give substantial reason to question what the ad buying was actually intended to accomplish.

The larger danger: surveillance without spyware infection

The most widely shared version of this story focuses on the moment malware enters a device. But successful device compromise was only one potential outcome.

Even when no exploit was delivered, advertising technology could collect information useful for identifying or following a person. Some of that data is routinely used in commercial marketing. In the wrong hands, it can become a map of somebody's movements, associations, interests, and digital habits.

The relevant tools include:

• IP addresses: clues about the network someone uses and, in some circumstances, their approximate location.
• Mobile advertising IDs: identifiers designed for advertising-related activity, which can be linked to other information about a device.
• Browser or advertiser cookies: identifiers that may help match a person across participating sites or services.
• Device fingerprinting: combinations of browser, hardware, screen, language, and network characteristics that can help recognize a device even when one identifier changes.
• Advertising bid data: information available to bidders in the process of offering to display an ad, sometimes without needing to win the auction.

Confiant's ADINT investigation documented more intrusive behavior. The researchers observed Discover-Tech-related scripts attempting to read first-party cookies on publisher sites. Across ad sessions involving more than 1,000 publisher domains, they found instances involving analytics IDs, advertising IDs, session identifiers, and sometimes personal information encoded in tokens.

There is an important technical limit. A script cannot simply read every cookie in every browser context. Properly isolated cross-origin frames restrict access, and cookies marked HttpOnly are not exposed to ordinary JavaScript. Confiant's finding was that some ad placements lacked sufficient isolation, making sensitive first-party cookie information accessible to the ad script.

A leaked session identifier can be more serious than a routine advertising identifier, depending on how the affected website manages sessions. But the research does not prove that every observed identifier was usable to seize an account, or that every advertiser can read every site's cookies.

The point is not that everyone was infected. It is that many people could be profiled or have data extracted without being chosen for infection at all.

Why does Palestine appear so prominently in the findings?

Confiant observed particularly heavy Discover-Tech advertising exposure in Palestine during its April 1 through September 10, 2026 monitoring period.

The firm reported that Discover-Tech served about 1.9% of all monitored advertising impressions there, with a daily peak of 9.9% on April 7. For Android impressions, its observed share was approximately one in 36, or 2.8%. Confiant also identified elevated Android exposure in Lebanon, Belgium, and Portugal.

These figures describe the advertising activity visible to Confiant's monitoring systems. They are not population-wide infection rates, counts of people under individualized surveillance, or evidence that a given Palestinian user was hacked.

Nevertheless, the geographic concentration is materially relevant, especially alongside the documented targeting of Al Jazeera. It shows that the activity was not evenly distributed across the internet and that a population already subject to intense security and intelligence scrutiny featured prominently in the observed data.

There is also a separate historical point worth keeping distinct: in Microsoft's 2021 investigation of Candiru-linked malware, approximately half of more than 100 identified victims were in the Palestinian Authority. That earlier finding does not prove the identity of any customer directing the 2024-2026 AdFection operations. It does establish that Palestinian victims have appeared prominently in prior documented Candiru activity.

The evidence justifies scrutiny of who purchased these capabilities, who was targeted, and for what purpose. It does not justify asserting an unidentified government's involvement as an established fact.

Did an Israeli spyware company also target Starlink users?

A separate investigation suggests that advertising surveillance extended into traffic associated with Starlink, SpaceX's satellite internet service.

On October 15, security researchers at TrendAI published an analysis of an advertising entity they called SHADOW-EARTH-79. The researchers documented unusual levels of ad buying in conflict-affected countries and on internet traffic associated with Starlink IP addresses.

Their observed figures included:

• 105 countries where SHADOW-EARTH-79 was the leading winning bidder in the monitored Starlink traffic.
• 12.9% of observed winning Starlink ad events attributed to that entity.
• An approximately 4.9-fold concentration in Starlink ads relative to its overall advertising footprint in the dataset.

In an October 27 Reuters investigation, reporter Raphael Satter cited six people familiar with the research who identified SHADOW-EARTH-79 as Discover-Tech. TrendAI had not publicly named the company in its original report and emphasized caution about attribution.

Why would Starlink matter? Satellite connectivity is used in places where conventional communications are restricted, damaged, or unreliable. Advertising traffic associated with a Starlink connection can give a surveillance operator another way to identify devices using that network, build profiles, and potentially infer where people are active when combined with other information.

But the findings do not show that Starlink satellites, terminals, or SpaceX systems were hacked. They establish abnormal ad-buying behavior in traffic associated with Starlink users, with a subsequently reported company attribution. They do not establish that all those users were located precisely, personally identified, or infected with spyware.

DARK CARTOGRAPHER: connecting ad identifiers to phone numbers

Citizen Lab also identified a separate actor, which it named DARK CARTOGRAPHER, using Discover-Tech-related infrastructure in an attempt to link mobile advertising identifiers to actual telephone numbers.

The technique exploited weaknesses involving mobile-carrier services, including systems intended to let users sign in or make purchases without manually entering a phone number. The researchers described cases where carrier-side identification features or third-party services could disclose telephone numbers in unintended circumstances.

Citizen Lab said it identified relevant weaknesses across mobile providers in more than 30 countries, and assessed that related activity went back to at least 2019. It was coordinating disclosures and had not completed public attribution of the actor when the October 15 report appeared.

This matters because an advertising identifier might look anonymous in isolation. Match it with a person's telephone number, and it becomes much easier to connect browsing and app activity with a real-world identity.

DARK CARTOGRAPHER should not be mistaken for a second confirmed Candiru infection campaign. It is a separate deanonymization operation, with a separate evidentiary record and unresolved attribution. The original Citizen Lab report provides the basis for that distinction.

Who are Discover-Tech and Candiru, and who was paying for the spying?

Discover-Tech is an Israel-based company established in 2020 that presented itself as an advertising technology business. Citizen Lab reconstructed its Controlium control interface and documented functionality for selecting devices using advertising identifiers, cookies, and IP addresses, as well as configuring campaigns that could return code to selected targets.

Citizen Lab identified Dekel Boni as Discover-Tech's CEO and examined the company's corporate connections. One former director, Eric Banoun, had previously co-founded surveillance businesses associated with the broader commercial spyware industry. Those relationships are evidence of industry connections, not proof that every associated individual directed a particular attack.

Candiru, which the research links to the successful Al Jazeera infections, is a separate Israeli spyware company. Citizen Lab reported that it had been rebranded as Integrity Labs, with its corporate ownership described in reporting as having changed. The precise legal structure is less important than the documented technical link between its spyware and Discover-Tech's ad delivery.

Candiru's history predates this investigation. In November 2021, the U.S. Department of Commerce placed Candiru and NSO Group on its Entity List. The department said the companies had developed and supplied spyware to foreign governments that used it to target journalists, officials, activists, academics, and other people. An Entity List designation restricts certain exports and transfers; it is not itself a criminal conviction.

Was the Israeli government behind AdFection?

The evidence supports the Israeli corporate origin of Discover-Tech and Candiru and the use of their infrastructure in attacks on Al Jazeera. It also documents relationships with other commercial surveillance companies, including Bindecy and Intelos.

As of November 7, 2026, the public investigation does not identify the specific government or customer that commissioned the Al Jazeera operation. Spyware vendors have historically sold capabilities to government clients, and that history creates a reasonable question about who directed the attacks. It is not a substitute for identifying the customer through contracts, logs, witnesses, or another independent evidentiary chain.

There is no need to obscure the established role of these Israeli firms. There is also no reason to present state attribution as settled when the original investigators have not established it.

How did mainstream ad companies let this happen?

This is where the story becomes a public-policy failure, not just a technical exploit.

Discover-Tech was included in Google's advertising-vendor systems and in the IAB Europe Global Vendor List beginning in 2020. Those listings helped the firm participate in the advertising marketplace and appear to other businesses as an approved participant. Citizen Lab traced its access to networks and intermediaries involving Google, Yandex, Beeswax, Vungle, Eskimi, and others.

The implication is stark: a business tied by investigators to mercenary surveillance could operate through ordinary advertising pipes for years. Publishers that displayed its ads were not necessarily aware of the final code being delivered or the hidden purpose of the campaign.

The ads themselves could look harmless, sometimes promoting ordinary products. The NOAS server could selectively return malicious code to an individual target while returning nothing to the scanners used to review advertising content. This design made abuse harder to catch through ordinary ad screening.

In response to investigative disclosures, Google terminated Discover-Tech's access in early October 2026 and deployed Safe Browsing warnings for known actor-controlled domains. IAB Europe removed Discover-Tech from its vendor list on October 8. Beeswax removed the company, Vungle paused its access for review, and Eskimi blocked related accounts and domains. Citizen Lab documented these actions, while WIRED obtained statements from several platforms.

That response matters and should be acknowledged. It also does not answer why the company received access in the first place, why years of unusual advertising behavior were not stopped earlier, or whether equivalent operations remain active elsewhere. No public follow-up identified in this audit through November 7 establishes additional confirmed victims or names the customer responsible for the Al Jazeera attacks.

The research does not establish that every ad platform or publisher knowingly participated in spyware attacks. But a platform can fail at security without knowingly agreeing to an attack. The relevant questions are what the company knew, what it could reasonably detect, what controls it had in place, and whether those controls were fit for the risks created by its own business model.

Discover-Tech and Candiru did not provide substantive responses to Citizen Lab's prepublication requests, according to the research. Some other businesses discussed in the report disputed knowing involvement. Those positions do not undo the forensic findings, but the distinctions are necessary when assigning responsibility.

Can clicking "Agree" on a cookie banner authorize spyware?

No. Consent to advertising-related data processing is not blanket consent to covert device compromise. Citizen Lab found that Discover-Tech's inclusion in industry registries could make the company part of consent flows shown to European users, raising a further question about whether those disclosures meaningfully described what the company was doing.

Whether specific conduct violated privacy, computer-misuse, or other laws is a matter for regulators and courts. The technical findings alone are not a final legal ruling. The practical failure is already visible: a framework presented to users as a privacy choice did not prevent the misuse documented by researchers.

Is Israeli spyware probably on your phone right now?

There is no evidence that this is probable for the average person. Exposure to ordinary tracking is widespread; confirmed mercenary spyware infection is a different and much more targeted event.

Apple's official threat-notification guidance explains that highly sophisticated mercenary spyware attacks usually require exceptional resources and are directed at a relatively small number of selected individuals. Journalists, political figures, dissidents, diplomats, human-rights advocates, and people involved in sensitive investigations may face heightened risks.

For everyone else, the reasonable response is to reduce exposure and maintain basic security protections, not to assume their phone has been hacked because they scrolled past an ad.

How can you tell whether your phone has spyware?

There is no simple consumer test that can conclusively rule out sophisticated spyware. Unusual battery drain, heating, or data use may have many innocent explanations; the absence of those symptoms is not proof that a device is clean.

A credible threat notification, a suspicious incident connected to your work, or evidence of deliberate targeting deserves attention. On Apple devices, verify a possible spyware notification by signing in independently at account.apple.com, rather than clicking a link in an unexpected message. Anyone with a credible high-risk case should seek specialized assistance instead of treating a generic antivirus scan as definitive.

How to protect yourself from malicious ads and zero-click spyware

No single setting eliminates this risk. The following steps address different parts of the attack path.

1. Keep operating systems, browsers, and apps updated. Patches close known vulnerabilities and are the first line of defense against many exploit chains.
2. Block ads and trackers where practical. A reputable browser-based blocker reduces exposure to malicious advertising scripts. It does not necessarily block ads inside separate mobile apps. Network-level or trusted DNS-based blocking may cover additional contexts, but no blocking method is universal.
3. Reduce advertising identifiers and personalized tracking. This limits some profiling and makes certain forms of cross-app matching more difficult. It does not make a device invisible to IP-based or other tracking.
4. Review app permissions, especially location access. Avoid giving unnecessary location permissions to ad-supported apps.
5. Use high-risk protections when appropriate. On supported Apple devices, Lockdown Mode restricts some complex features attackers may exploit. It imposes usability tradeoffs and is designed for people at elevated risk, not as a routine requirement for everybody.
6. Get specialist help if you have credible reason to believe you are being targeted. Preserve relevant alerts and consult a trusted digital-security organization before taking destructive troubleshooting steps that could erase evidence.

Android: reduce ad tracking

The Committee to Protect Journalists' practical guide recommends reviewing Android's advertising privacy controls, disabling ad topics and measurement where available, deleting the advertising ID on supported versions, and limiting app location permissions. On many devices, these controls appear under Settings > Google > All services > Ads or within Settings > Privacy > Ads. Menu wording varies by Android version and phone manufacturer.

Deleting an advertising ID reduces one form of identification. It does not erase information already collected or guarantee protection against an exploit.

iPhone: reduce tracking and use stronger security when needed

On iPhone, review Settings > Privacy & Security > Tracking to restrict app tracking requests. For especially high-risk individuals, Apple's Lockdown Mode instructions explain how to turn on stronger device protections under Settings > Privacy & Security > Lockdown Mode.

If Apple sends a mercenary spyware threat notification, follow its official verification and response guidance. Apple recommends expert assistance, including through Access Now's Digital Security Helpline.

What should businesses and website publishers do?

Publishers, employers, and government agencies should not treat spyware-through-ads as a problem that users alone must solve. The Confiant findings on first-party cookie exposure make clear why ad integrations matter.

Practical controls include isolating third-party advertising code from the site's own origin, using appropriate sandboxing and cookie protections, auditing vendor relationships, monitoring unexpected outbound requests, and considering stronger ad blocking on sensitive organizational devices and networks. These are risk-reduction measures, not promises that a sophisticated attacker can never get through.

What needs to change in the advertising industry?

The response cannot stop at telling the public to install an ad blocker. People did not consent to becoming attack targets simply by opening a website.

The evidence points to several responsibilities:

• Ad exchanges and vendor registries need meaningful, recurring checks of corporate ownership, business purpose, technical behavior, and suspicious advertising patterns rather than relying primarily on applications and self-declarations.
• Publishers and ad intermediaries need to restrict what third-party scripts can read or execute, and prevent advertisers from reaching sensitive first-party data through poorly isolated ad placements.
• Platforms need to detect selective malicious payload delivery, not merely scan the benign version of an ad shown to ordinary reviewers.
• Regulators should examine whether existing privacy, security, and export-control laws were violated, and whether the underlying transfer of precise user-level data to large numbers of bidders requires stronger limits.
• Government agencies and high-risk organizations should treat ad exposure as part of their security threat model, including on devices used for sensitive work.

These proposals follow the risks and recommendations set out by Citizen Lab and TrendAI. They do not depend on proving that every advertising company intended to facilitate espionage. The market's architecture created an opportunity that the confirmed operators were able to exploit.

Frequently asked questions

Can just scrolling past an ad install spyware?

Yes, in a successful zero-click exploit. A malicious ad can initiate the attack when it loads, even without a click. This does not mean that every ad, or every visit to a website that displayed Discover-Tech advertising, caused an infection.

Can an iPhone or Android phone get spyware from an ad?

Yes, mobile devices can be targeted by this technique. Apps and mobile browsers can expose devices to ad-delivered code, and sophisticated attackers can exploit mobile vulnerabilities. The AdFection investigation establishes a real zero-click attack method but does not provide a public count of successfully infected iPhones or Android phones. The most concrete recovered malware sample described in the Al Jazeera case was from Windows.

Could an ad on Yahoo, the BBC, or another major website be involved?

Citizen Lab documented Discover-Tech advertising reaching numerous recognizable sites and apps, including sessions observed on Yahoo. A publisher displaying an ad is not proof that it knew about the spyware or that visitors were infected. The point is that major sites can participate in ad systems that admit third-party code and intermediaries.

Does an ad blocker prevent AdFection?

A trustworthy ad blocker can substantially reduce exposure to malicious advertising, and researchers recommend it as a protective measure. It is not a guarantee: coverage differs across browsers, apps, operating systems, and network configurations, and sophisticated exploits may use other routes.

Is AdFection the same as Pegasus?

No. AdFection describes an advertising-based targeting and exploit-delivery technique. Candiru is a spyware vendor linked to the confirmed infections in this case. Pegasus is a separate spyware product associated with NSO Group. A delivery technique, a spyware vendor, and an individual spyware product are not interchangeable terms.

Has Discover-Tech been shut down?

Major advertising intermediaries blocked, removed, or suspended its access in October 2026. As of November 7, there is no verified public evidence that the company ceased all operations, that every associated surveillance server went offline, or that other companies cannot employ similar methods.

Does this prove Israel can secretly turn on everyone's camera?

No. It documents surveillance capabilities developed or enabled by Israeli companies and confirmed infections in a targeted campaign. It does not establish universal access to phones, mass camera activation, or the identity of the government customer behind the Al Jazeera operation. Those claims require separate evidence.

The broader finding

The October reporting was not nonexistent. WIRED, Reuters, and other outlets brought the findings to public attention. The unanswered question is whether the companies that enabled this advertising access, and the institutions responsible for enforcing rules, will make changes that prevent the next operation.

For a related investigation separating documented Israeli surveillance capabilities from viral claims about direct government control of devices, see sherafy.com's analysis of Netanyahu's "penetrate this machine" remark.

The AdFection case establishes something more fundamental than a new kind of malicious advertisement. The advertising economy developed systems capable of recognizing individual people across the internet, bidding to reach them, and sending code to their devices. Researchers have now shown that those systems were used for espionage and confirmed zero-click infections.

The victims did not need to click the wrong thing. The system did not require them to do anything wrong at all.

References and Further Reading

Primary technical investigations

• Citizen Lab: Exposing AdFection – How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (University of Toronto, October 15, 2026). The principal forensic report, including the Al Jazeera infections, Controlium and NOAS systems, bidding records, corporate research, vendor relationships, and DARK CARTOGRAPHER findings.
• Confiant: ADINT – Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming (October 15, 2026). Independent analysis of Discover-Tech advertising code, fingerprinting, cookie collection, campaign telemetry, and disproportionate exposure in Palestine.
• TrendAI: Invasive Ads – The Unconventional Cyber Surveillance Attack Surface (October 15, 2026). Original advertising telemetry on SHADOW-EARTH-79, conflict-region bidding patterns, and disproportionate targeting of observed Starlink traffic.

Government records and prior security research

• U.S. Bureau of Industry and Security: Commerce Adds NSO Group and Other Foreign Companies to Entity List (November 4, 2021). Official agency announcement explaining the November 2021 addition of Candiru and NSO Group to the Entity List and the basis for export restrictions.
• Microsoft: Protecting Customers from a Private-Sector Offensive Actor Using 0-Day Exploits and DevilsTongue Malware (July 15, 2021). Technical history of Candiru-linked malware, exploits, and a distinct earlier victim population.

Original reporting and affected-party response

• WIRED: 'Nightmare Scenario' – Zero-Click Spyware Is Infecting Phones via Targeted Ads (October 15, 2026). Interviews and industry responses concerning the newly documented attack method.
• Reuters: Israeli Firm Used Online Ads to Run Vast Spy Operation, Researchers Say (October 15, 2026, via Al-Monitor). Independent reporting on the original disclosures, reach of the ad campaigns, and affected institutional networks.
• Reuters: Alleged Israeli Spy Company Heavily Targeted Starlink Users, Sources Say (October 27, 2026, via Al-Monitor). Follow-up identifying SHADOW-EARTH-79 as Discover-Tech according to six sources and explaining the Starlink angle.
• Al Jazeera: Israeli Ad-Tech Firm Helped Place Spyware on Al Jazeera Devices (October 15, 2026). Reporting that includes the affected network's response to attacks on its staff.

Practical security guidance

• Committee to Protect Journalists: Protecting Against Advertising Technology (August 27, 2026). Actionable guidance on mobile advertising IDs, permissions, ad blocking, and privacy settings.
• Apple: About Threat Notifications and Protecting Against Mercenary Spyware. Official explanation of Apple's high-confidence spyware alerts and how recipients should respond.
• Apple: About Lockdown Mode. Official instructions and limitations for Apple's additional high-risk device protections.
• Access Now: Digital Security Helpline. Specialist security assistance for people facing credible digital threats.

Editorial currency note: This article reflects public evidence reviewed through November 7, 2026. Surveillance attribution, corporate relationships, platform enforcement actions, software protections, and any future regulator findings may change. Bids, ad impressions, contacted devices, targeted devices, and confirmed infections are distinct measurements throughout this article.