Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
Citizen Lab reported that government spyware makers, including Israeli company Discover-Tech, are abusing global advertising networks to deliver zero-click spyware. Malicious online adverts served through ad networks are used to target and hack victims' devices without any user interaction, a novel delivery vector for commercial surveillance tools. Targets are individuals selected by government clients; the report was published Thursday (2026-10-22) by the University of Toronto lab. No CVE or technical fix is stated; mitigation relies on ad-network abuse detection and device-level protections rather than a vendor patch.
What to do
- Harden devices against drive-by/zero-click compromise: enable OS security updates, lockdown modes and mobile MDM controls for at-risk staff
- Consider network-level ad and tracker blocking for high-risk users
- Monitor for indicators of compromise published by Citizen Lab
- Review exposure of staff in high-risk roles (journalists, activists, officials) to targeted surveillance
- Follow Citizen Lab and vendor advisories for further technical detail
Sources
All live incidents on Threat Watch