A report highlighted by SecurityWeek links advertising technology infrastructure to the delivery of zero-click spyware, underlining how third-party scripts embedded in websites and apps can create security and privacy risks beyond traditional malware channels. According to the report, ads served by Israeli company Discover-Tech were used by threat actors connected to spyware vendor Candiru to fingerprint devices at scale, track users and selectively infect targets.

While the reported activity appears to be targeted rather than a broad attack on ordinary companies, the case is highly relevant for European businesses that rely on ad-tech, analytics tags and other external website components. It also raises wider questions about vendor due diligence, web supply-chain security and compliance where tracking technologies collect device-level data.

What happened

SecurityWeek reported that Discover-Tech’s advertising infrastructure doubled as a delivery channel for Candiru-related spyware activity. The reported mechanism allowed threat actors to use ads not only for visibility across websites and digital placements, but also for device fingerprinting, large-scale tracking and the selective delivery of zero-click spyware to chosen targets.

Zero-click attacks are particularly concerning because they do not require a victim to open a file or click a link. In practice, that means compromise can occur through content delivery or software handling processes that are invisible to the user.

Based on the source provided, the report concerns alleged abuse of ad infrastructure as part of spyware operations. The source text does not establish that all customers of the ad company were affected, nor does it indicate broad legal findings or confirmed impact on European businesses specifically.

Why it matters for European businesses

For European companies, the main significance is not only the spyware angle but the broader third-party risk problem. Many business websites, e-commerce stores and mobile apps depend on advertising tags, analytics scripts, consent tools, chat widgets and other externally hosted code. If one of those components is abused, it can create exposure that the website owner may not immediately detect.

This matters in several ways:

• Website security: External scripts can become an indirect attack path into customer-facing digital properties.
• Privacy and compliance: Device fingerprinting and cross-site tracking can trigger GDPR concerns, especially if companies cannot clearly account for what data third-party technologies collect and why.
• Brand and customer trust: If malicious or abusive activity is delivered through website components, customers may associate the incident with the business hosting the page.
• Supply-chain governance: Marketing and growth teams often add ad-tech and martech tools quickly, while security review may lag behind.

The case also reflects a broader trend: advertising and analytics infrastructure can be attractive to attackers because it offers reach, scale and visibility across many sites and devices.

Who may be affected

The story is most relevant for organisations that embed third-party advertising or tracking technology into websites, apps or campaign landing pages, including:

• SMEs running marketing-heavy websites
• E-commerce businesses using multiple ad and retargeting platforms
• Marketing teams deploying tags through tag managers without formal security review
• IT and web teams responsible for script governance and front-end security
• Agencies managing advertising, website optimisation and martech stacks for clients

It may also matter for regulated organisations and high-profile companies whose staff, executives or partners could be of interest in targeted surveillance campaigns.

What companies should consider

European businesses do not need to assume that every ad-tech provider is unsafe, but this case is a reminder to treat third-party web components as part of the security perimeter.

• Review third-party scripts: Maintain an inventory of advertising, analytics and marketing scripts running on websites and apps.
• Reduce unnecessary dependencies: Remove tools that no longer have a clear business purpose.
• Strengthen vendor due diligence: Ask providers about security controls, incident response processes and data collection practices.
• Limit script permissions where possible: Use technical controls and web security policies to reduce the reach of external code.
• Coordinate security and marketing teams: Changes to tags, pixels and ad integrations should not bypass security oversight.
• Check privacy implications: Assess whether fingerprinting, tracking or profiling by vendors aligns with your consent framework and GDPR obligations.
• Monitor for abnormal behaviour: Watch for unexpected network calls, browser-side activity or unexplained changes in website performance and telemetry.

For businesses with higher exposure, especially those in regulated sectors or those handling sensitive customer and employee data, this incident is a useful prompt to revisit web supply-chain security and third-party risk management across both marketing and IT operations.