A groundbreaking investigation by a Canadian research group has revealed a terrifying new frontier in digital surveillance: spyware that can infiltrate your smartphone through a simple online ad, without you ever needing to click on it.

The University of Toronto’s Citizen Lab, which uncovered the threat, refers to the technology as “zero-click mercenary spyware.” According to the researchers, the exploit completely bypasses user interaction, silently compromising devices and granting attackers unprecedented access to personal data and real-world movements.

The “God-Like” Threat

“This is really god-like capabilities,” said Ron Debert, the director of Citizen Lab and co-author of the report.

According to Debert, once a device is infected, the level of surveillance is near-absolute. Attackers can:

• Turn the targeted phone into a live bug to listen to conversations in a room or from a pocket.
• Pinpoint and track the user’s exact physical location.
• Monitor daily routines and physical movements.
• Discover exactly who the target is meeting with in real-time.

How Does It Work?

Unlike traditional phishing scams or malicious downloads that require a user to make a mistake, this zero-click attack is entirely passive.

If a user is targeted, a malicious advertisement simply needs to appear on their device’s screen. Once the ad loads, it silently profiles the device, scans for existing software vulnerabilities, and hacks it by implanting harmful surveillance programs in the background.

High-Profile Targets

While Citizen Lab could not definitively identify the individual clients utilizing this spyware, the scope of the targeting is highly alarming. The researchers found evidence that the malicious ads were profiling individuals within highly sensitive international entities, including:

• Nuclear research facilities in Australia
• The Prime Minister’s office in Armenia
• The Ministry of Defense in Italy
• The Ministry of Foreign Affairs in Czechia
• The Ministry of Defense in Israel

Furthermore, the researchers confirmed that at least 45 devices belonging to employees at the international news network Al Jazeera were directly targeted by the spyware.

Who is Behind the Spyware?

The Citizen Lab report points fingers at two Israel-based entities. The ad placement is allegedly facilitated by a company called Discover Tech, which purports to be a legitimate advertising firm but appears to operate as a front for large-scale “ad espionage abuse.”

The spyware itself is allegedly manufactured by a company known as Kandiru (also known as Integrity Labs). Both Discover Tech and Kandiru have previously been blacklisted by the United States government. Neither company responded to requests for comment regarding the allegations.

A “Broken” Ecosystem

The discovery highlights a glaring vulnerability in the modern internet infrastructure. “We’ve got a broken data targeted advertising ecosystem,” Debert warned. “It’s ripe for abuse.”

While utilizing ad-blocking software can offer a layer of protection against these specific attacks by preventing the malicious ads from loading in the first place, Debert stresses that true safety will require sweeping government intervention and systemic changes to how online advertising operates.