An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday.

An investigation by the University of Toronto’s Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named “AdFection.” The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims.

“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system,” said Bill Marczak, senior researcher at The Citizen Lab. He said the findings were “surely just the tip of the iceberg” of how online ads are abused for espionage.

Researchers discovered critical details of the hacking tools by analyzing devices belonging to journalists and staff at the Al Jazeera media network, finding that 45 devices of journalists and staff were targeted and some infected with Israeli-made spyware known as Candiru.

At the heart of the hacking campaign is the Israeli company Discover-Tech that describes itself as an advertising business. Citizen Lab researchers said the company facilitated surveillance for commercial spyware operators. Its platform, called Controlium, allegedly allowed spyware makers like Candiru — which in 2025 was acquired by Integrity Labs — to identify, track and target devices by loading advertisements on websites and apps.

Discover-Tech and Integrity Labs did not immediately respond to a request for comment.

The scale is striking: An analysis of four billion advertising records found that Discover-Tech’s ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU.

The technique exploits real-time bidding — the automated system used by platforms such as Google to sell advertising space and target users. Rather than persuading victims to click a malicious link, attackers can exploit advertisements to identify and potentially infect devices without any interaction from the user — a technique known as “zero-click” infections.

Discover-Tech’s advertisements directed millions of devices to servers associated with Candiru, potentially enabling large-scale surveillance and reconnaissance, researchers said. That does not mean all those devices were infected.

Citizen Lab, based in Toronto, is a globally recognized research group that previously uncovered spyware scandals targeting Catalan political figures, a member of the European Parliament and the inner circle of murdered Saudi journalist Jamal Khashoggi.

The findings triggered calls for further investigation on Thursday. “The possibility that EU institutions have been exposed should set off alarm bells across Brussels,” said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group.

“Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,” Neumann said.

Ukraine’s strikes on data centers inside Russia aimed to disrupt military planning and communication services. There were also reports of another kind of disruption: to customers waiting for their dinner from food-delivery apps.

Kyiv’s drone strikes on three Yandex data centers in Sasovo, Kaluga and Vladimir saw delays and interruptions for thousands of businesses and households that rely on Yandex’s cloud infrastructure, including e-commerce, digital payment platforms and apps of food delivery and car services. Ukrainian drones on Wednesday targeted a major Sberbank data center in Russia’s Saratov region, though a senior company executive said it hadn’t affected operations.

After the strikes on Russian data centers, Kyiv noted that Moscow has already repeatedly targeted its digital infrastructure. “Ukrainians wanted to show Russians that two can play this game,” a senior official familiar with the operation told POLITICO, granted anonymity to discuss sensitive matters.

The attacks and counter-attacks point to a new frontline in war: the infrastructure powering the digital economy.

The attacks on the buildings that supply compute power are akin to striking a power plant supplying the electricity, heating and fuel that both militaries and civilians depend on. It may weaken an enemy’s war effort but can also bring everyday life to a standstill.

Experts say the cost of rebuilding in Russia will be particularly high as the centers require scarce materials that must be imported. “Obtaining a large amount of equipment to replace what was destroyed is not going to be easy,” said Oleg Shakirov, a cyber policy and international security researcher, noting that most hardware needs to be imported and that is complicated by high global demand and sanctions on Russia.

“To be honest, no one really knows what’s the actual damage. Since two data centers are still offline, we can assume that it’s significant,” said Shakirov.

Joseph Jarnecki, a senior research fellow at the Royal United Services Institute, warned that normalizing strikes to data centers could have a new set of dangerous consequences.

“These strikes likely breach International Humanitarian Law and it’s a big risk when global populations increasingly rely on digital services,” he told POLITICO.

When servers become targets

Data centers have entered the crosshairs of other recent armed conflicts. During the U.S.-Israeli conflict with Iran earlier this year, drone strikes hit three Amazon Web Services (AWS) facilities in the United Arab Emirates and Bahrain.

Since data centers can serve civilian and military purposes simultaneously, the legal status of targeting them is far from straightforward.

Kubo Mačák, an expert on international humanitarian law, said a data center must meet two conditions to qualify as a military objective under the Geneva Conventions: it must make an effective contribution to military operations and destroying it must offer a “definite military advantage.”

“If you know that they are storing military intelligence or that they’re using the data center to power military artificial intelligence tools,” Mačák said, there could be grounds to consider it a military objective.

Following the most recent strikes of the Yandex data centers, users on social media platform X reported a sudden drop in automated bot activity, including from accounts associated with pro-Russian, pro-Trump and Germany’s far-right Alternative for Germany (AfD) narratives.

Ukrainian President Volodymyr Zelenskyy seized on the reports to boast that the strikes had made social media less toxic, even as independent researchers and national research institutes found no evidence they specifically disrupted any Russian disinformation campaigns.

Mačák said that even if a data center is being used to “let’s say, run some trolls or these bot farms to interfere with elections abroad … that would not be sufficient.” In other words, hosting propaganda bots does not, by itself, make a data center a lawful military target.

The dual-use quandary has often focused on the targeting of energy infrastructure, which has been frequent in the Russia-Ukraine war. On Saturday, U.S. President Donald Trump urged Ukraine to stop striking Russian oil refineries, blaming the attacks for rising fuel prices. He has since called for both sides to halt attacks on energy infrastructure, although the existence of any ceasefire agreement remains disputed.

As data centers become increasingly central to national economies, they will become more consequential targets. A senior NATO official granted anonymity to discuss the matter told POLITICO that data centers are already considered potential targets and that the alliance is factoring their vulnerability into its planning.

NATO allies recognize that their data centers could come under attack in a conflict, the official said: “We would get it in a fight.”

Veronika Melkozerova in Kyiv contributed to this report.