Citizen Lab published a report on Oct 15 (co-timed with ad-security firm Confiant) that it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. It links, with high confidence, zero-click attacks on at least 45 devices at Al Jazeera in 2024–2025 to Candiru spyware (reportedly now owned by US-based Integrity Labs) delivered via ads bought by Israel-based Discover-Tech. Discover-Tech's Controlium platform profiles and de-anonymizes users from real-time-bidding data (ad ID plus IP); selected targets are later served malicious JavaScript that exploits the device, while the ads themselves carry no exploit code. Citizen Lab says ad-bidding records showed Discover-Tech ads reaching millions of devices, including impressions on NATO, EU institution, government, critical-infrastructure and media networks; it stresses an impression alone does not confirm targeting or infection. Google and IAB Europe removed Discover-Tech from their vendor lists, and Google and Beeswax cut off its access. Defender takeaway: ad blocking and limiting ad-ID tracking on high-risk staff devices is now a spyware control, not just privacy hygiene.