# AdFection: Citizen Lab finds spyware delivered via ads

URL: https://techaiwire.com/articles/citizen-lab-adfection-discover-tech-candiru-zero-click-spyware-ads/

_By Claire Whitmore - Oct 15, 2026_

**By the numbers:**

- 45 - Al Jazeera devices targeted in 2024 and 2025, per Citizen Lab
- 120,768 - websites that showed Discover-Tech ads, March to June 2026
- 75,373 - mobile apps that showed its ads in the same period
- $109,091 - approximate ad spend in that data, per Citizen Lab

Citizen Lab, a research group at the University of Toronto, says an Israeli company used targeted online ads to deliver spyware to chosen people without a single click. Its report, published October 15, 2026, names the technique AdFection. It is the first public technical demonstration of mercenary spyware delivered through ads, [CyberScoop reports](https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/). Mercenary spyware means commercial hacking tools sold to paying clients. The finding turns ordinary ad slots on websites and apps into an attack route.

## How AdFection works

The company, Discover-Tech, bought ad space through normal ad auctions, the [Citizen Lab report](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) says. Its ads carried a small script that worked in four steps:

1. **Identify the viewer.** The script sent the device's advertising ID and IP address to a Discover-Tech server. An advertising ID is the tracking code a browser or phone shares with ad companies.
2. **Pick targets.** The server checked each ID and address. Anyone not on the list got an empty reply.
3. **Run code.** Chosen targets received JavaScript that ran automatically. No click was needed.
4. **Hand over.** Infected devices then contacted servers linked to Candiru, a spyware maker now branded Integrity Labs.

Discover-Tech kept the malicious code away from the ad companies it bought from, the report says. It sold the service through a platform called Controlium. According to CyberScoop, Controlium lets partners "de-anonymize, fingerprint, and automatically infect devices" when an ad appears.

## Who was targeted

Citizen Lab links at least 45 devices at Al Jazeera, the news network, to Candiru spyware delivered this way in 2024 and 2025. The sources differ on the detail. [TechCrunch](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/) reports that 45 Windows computers were hacked. Citizen Lab says the devices were targeted, and that it analyzed a Windows file from one compromised device.

Citizen Lab cannot yet say who ordered the attacks, CyberScoop reports.

Confiant, an ad security company, ran its own investigation alongside Citizen Lab. It found signs of Discover-Tech ads on sensitive networks, including those of the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court. Seeing an ad does not mean a device was infected, Citizen Lab notes.

## How far the ads reached

The researchers obtained bidding data from MyDSP, one of the ad-buying platforms Discover-Tech used. Between March and June 2026, the data shows:

| Measure | Figure |
|---|---|
| Ad bids placed | 3,770,286,576 |
| Bids won | 441,954,291 (11.7%) |
| Websites reached | 120,768 |
| Mobile apps reached | 75,373 |
| Share of bids inside apps | 76.7% |
| Approximate spend | $109,091 |

MyDSP's traffic came mostly from Yandex's ad exchange (67.4%), Google Ad Manager (24.74%) and Vungle (7.24%), the report says.

Part of Discover-Tech's own system was left open, TechCrunch reports. Researchers could download user login records without a password, including records for some Candiru and Bindecy staff. Bindecy is a hacking company the report links to Discover-Tech.

## How the ad industry responded

Several companies acted before the report came out, Citizen Lab says:

- **Google** cut off Discover-Tech's access to its ad exchange and added Safe Browsing protections.
- **IAB Europe**, an ad industry body, removed Discover-Tech from its vendor list.
- **Vungle**, owned by Liftoff, paused all Discover-Tech access during a review.
- **Beeswax** removed Discover-Tech from its platform, and **Eskimi** permanently blocked its accounts.

Discover-Tech, Candiru and Bindecy did not respond to CyberScoop.

Bill Marczak, a senior researcher at Citizen Lab, told TechCrunch that "now for the first time, we have concrete technical evidence showing this process in action." Marczak called Discover-Tech "surely just the tip of the iceberg."

"Digital advertising is broken," Wolfie Christl, a senior researcher at Citizen Lab, told CyberScoop.

## What this means for developers

For teams that build apps, run ad-supported sites or manage company devices:

- **Treat ad scripts as untrusted code.** Any ad slot can run a buyer's JavaScript. Isolate ad frames and limit what third-party scripts can reach on your pages.
- **Block ads on work devices.** Citizen Lab advises organizations to block ads and tracking at the network gateway and on work devices. Use device management to opt staff phones out of ad targeting.
- **Limit advertising IDs.** Citizen Lab tells users to reset their phone's advertising ID regularly and turn off ad tracking. "It's time to disable ad tracking on your devices," Marczak told TechCrunch.
- **Vet your ad partners.** Citizen Lab calls on ad companies to verify who they sell to and to audit vendors again over time. Site and app owners should ask their ad networks how they screen buyers.
- **Watch traffic after ads load.** Citizen Lab suggests monitoring network traffic linked to ad impressions. An unexpected connection right after an ad appears is a warning sign.

## Sources

- [Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) - Citizen Lab
- [AdFection: How mercenary spyware invades victims' devices through targeted advertising](https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/) - CyberScoop
- [Citizen Lab says governments are abusing online ads to hack people with 'zero-click' spyware](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/) - TechCrunch