Zero-clickTspywareTZ
Researchers now have hard technical proof that simply showing someone an ad can hand their phone to a spyware vendor — and the ad network that did it was carrying the industry's own "certified vendor" stamp for six years. Also today: Google's cross-retailer Universal Cart went live in the US.
Citizen Lab says dozens of devices at Al Jazeera were infected with mercenary spyware from Candiru, now rebranded Integrity Labs, through ordinary targeted ads — no tap, no download, no prompt. It is the first public technical confirmation of the technique, which the University of Toronto lab calls AdFection. The report, co-timed with an investigation by the ad-security firm Confiant, names the intermediary as Discover-Tech, an Israeli company that presents itself as a normal advertising agency but which Citizen Lab found operates as a facilitator for several spyware vendors. Its platform, Controlium, uses the real-time bidding system to de-anonymize and fingerprint individual users, then returns malicious JavaScript in the ad slot to the ones a client wants infected. Analysis of nearly four billion bidding records found Discover-Tech ads rendered on almost 200,000 websites and Android and iOS apps across dozens of countries, and its ads reached networks belonging to defence ministries, armed forces, cyber agencies, NATO, the UN and the International Atomic Energy Agency. Google said it collaborated on the investigation; it removed Discover-Tech from its vendor registry and cut off its ad-exchange access in early October, and Beeswax, Vungle and Eskimi took similar action after being contacted.
The part worth sitting with is how much infrastructure this had to pass through unnoticed. Discover-Tech appeared on lists of "certified" and "approved" ad vendors maintained by Google and IAB Europe from 2020 until this month, and it bought inventory through major networks including Google, Yandex and Beeswax — plus, per Citizen Lab, it leaned on GDPR consent frameworks to target users inside the EU. Its shareholders included a company linked to someone who managed the corporate network of Intellexa, one of Europe's most notorious spyware groups. The delivery mechanism is the same programmatic auction that funds most of the free web: your device broadcasts identifiers to solicit bids, someone wins, and code runs in the ad slot. That design turns a router of ad impressions into a code-execution path with better targeting data than most attackers could ever buy. Citizen Lab's John Scott-Railton told readers the practical mitigation is blunt — block ads — while the report asks regulators to investigate Discover-Tech and Candiru under existing law. The ad industry's detection systems did not catch any of this for years, which is the finding regulators are most likely to act on.
Google's Universal Cart is now rolling out in the US across the Gemini app and Google Search, turning the shopping cart from a single-retailer holding pen into a cross-merchant layer that watches prices for you. Google previewed the tool at I/O in May; what's new is availability. You add products from different retailers as you browse Search AI Mode or chat in Gemini, and they land in one cart that runs on Gemini models to flag price drops, restocks and promo codes, and to point out incompatible parts if you're building something piecemeal. Checkout runs through the Universal Commerce Protocol Google co-developed with retailers: pay in Google Wallet using the card perks it thinks suit the purchase, or transfer items back to the merchant's own cart. Brands stay merchant of record either way, which is the concession that got Nike, Target, Walmart, Sephora, Ulta Beauty and Wayfair on board.
Two caveats. The checkout flow, not the cart, is the half still in flight — The Verge's demo shows the cart handling one retailer per transaction rather than splitting a mixed basket, and Google says YouTube and Gmail integration has no timeline. And this is a landgrab, not a technical milestone: OpenAI, Meta and Shopify are all pushing agents into the same checkout lane, betting that whoever owns the cart owns the default merchant. Agentic commerce has been arriving in instalments all year — Alipay's payment robot dog went shopping showed how far the payment side had already moved.
What to watch: whether any regulator opens an inquiry into Discover-Tech now that Google and IAB Europe have cut it loose, and whether Universal Cart reaches Gmail and YouTube before the holiday spending window closes.
Should ad exchanges be liable when a programmatic bid turns out to be the delivery vehicle for spyware, or is that only the advertiser's problem? Tell us in the comments.
