Skip to the rundown
GetYourBrief Cybersecurity desk · October 15, 2026
Search

Threat intelligence · on the rundown Thursday, October 15, 2026

Zero-click spyware delivered through online ads, researchers find

Covered by 10 outlets over 7 hours. First reported by NBC News at 10:00 UTC on October 15, 2026.

10 outlets

What happened?

  1. Researchers describe the case as the first technical evidence of a zero-click attack, requiring no user action, delivered through targeted advertising.
  2. Discover-Tech's Controlium platform allegedly lets spyware partners profile and de-anonymise millions of people, fingerprint devices and select targets by IP address, mobile ad ID or browser identifier, according to the investigation.
  3. Candiru, described in the reports as an Israeli spyware company, has been blacklisted by the US government.
  4. Google and Comcast-owned Beeswax have removed Discover-Tech from their platforms, and IAB Europe suspended the firm from its approved vendor list, Reuters reports.

Citizen Lab and Confiant say they found the first technical evidence of a zero-click attack delivered through targeted advertising, via Discover-Tech's Controlium platform and Candiru-linked spyware. The researchers say at least 45 devices at Al Jazeera were targeted in 2024 and 2025. Google, Beeswax and IAB Europe were reported to have since removed or suspended the firm.

A machine summary written from the reports listed below; read them for the full account. How summaries are made and what is checked.

Who reported it, and when?

10 distinct reports run by 10 outlets, earliest first (UTC); a syndicated report lists every site that ran it
TimeReportRun by
Oct 15 10:00Report by NBC News
  • NBC News
Oct 15 10:05Report by Reuters
  • Reuters
Oct 15 10:27Report by The Jerusalem Post
  • The Jerusalem Post
Oct 15 10:43Report by citizenlab.ca
  • citizenlab.ca
Oct 15 12:15Israeli firm’s digital ads enabling installation of ‘zero-click’ spyware, researchers say - The Guardian
  • The Guardian
Oct 15 12:50CitizenLab Details New Spyware Triggered By Online Advertising - Engadget
  • Engadget
Oct 15 13:43Report by thecradle.co
  • thecradle.co
Oct 15 13:47Report by www.calcalistech.com
  • www.calcalistech.com
Oct 15 16:32Report by Committee to Protect Journalists
  • Committee to Protect Journalists
Oct 15 17:01Report by The Verge
  • The Verge

A report's title is shown once our automated legal check has read it and passed it; 8 reports are named by outlet, and the links lead to each report.

Who was named?

More news naming Google

  1. Oct 15 · AI Google ties its new shopping cart to its agent checkout protocol 2
  2. Oct 14 · Legal Microsoft launches Copilot for Legal with 20-plus skills 5
  3. Oct 14 · Marketing Google Ads adds channel priority labels and daily budget caps 2
  4. Oct 14 · AI Microsoft's weather AI corrects model bias instead of building a new model 2
  5. Oct 14 · Finance Jio Platforms IPO priced at $108 billion, below earlier talks of $130 billion-plus 5
  6. Oct 13 · Legal Google launches Gemini 4 Argon globally 2

Sources: the outlets' reports linked on this page; counts and times from GetYourBrief's record of those reports (methodology).