The short version
Targeted advertising has been confirmed as a working delivery channel for zero-click spyware. Citizen Lab’s October 15, 2026 report shows Discover-Tech’s Controlium platform pushing Candiru spyware to at least 45 Al Jazeera devices through ordinary ad auctions. If your mobile apps or websites render third-party ads, that code path now belongs in your threat model.
What did Citizen Lab find?
Citizen Lab, the digital-rights research unit at the University of Toronto, says it has the first public technical evidence that mercenary spyware is being delivered through targeted online ads. Its researchers tied infections of at least 45 Windows computers at broadcaster Al Jazeera in 2024 and 2025 to Candiru, an Israeli spyware maker, and traced the delivery to ads bought through Controlium, a targeting platform sold by Israeli firm Discover-Tech.
The investigation was helped by Discover-Tech’s own security mistakes. According to the report, Controlium trusted unsigned user data instead of validating its login tokens, and an unauthenticated endpoint exposed around four months of login records. Those logs let researchers link platform accounts to Candiru staff and to a second vendor, Bindecy. “There has been a lot of buzz that online ads can be used to identify and hack targets with precision, but now we have technical evidence,” senior researcher Bill Marczak told TechCrunch.
How does an ad become an exploit?
The attack rides on the normal mechanics of real-time bidding. When an app or web page has an ad slot, a bid request goes out carrying identifiers such as the mobile advertising ID, cookie IDs and the device’s IP address. Controlium let customers upload the identifiers of chosen targets and bid only when those devices appeared.
The winning ad contained a small script that called back to a Discover-Tech server. That server checked the advertising ID and IP address again and, for everyone except the target, returned nothing. For the target, it returned JavaScript that could load a browser exploit and hand the device to the spyware operator. Nothing visible happens on screen, and to an ordinary ad-quality scanner the creative looks clean, because the malicious part is only ever served to one device.
How far did the ads reach?
Citizen Lab analysed nearly 4 billion bid records from Discover-Tech’s buying platform between March and June 2026. Its ads won about 442 million impressions and appeared in 75,373 mobile apps and on 120,768 websites in 161 countries, on a budget of roughly $109,000 with zero recorded conversions — a strong sign the campaigns were not about selling anything.
Impressions also landed on sensitive networks: NATO and UN networks, EU institutions, government and defence networks in several European countries and Australia, and, according to Confiant, the US Department of Defense. Not every impression was an attack, but each one put the delivery mechanism in front of a device on those networks.
How has the ad industry responded?
Discover-Tech had sat on Google’s and IAB Europe’s certified vendor lists since 2020. After the findings were shared, Google ended the company’s access to its ad exchanges and IAB Europe removed it from its global vendor list; Beeswax removed it and Vungle (Liftoff) paused its access pending review. Discover-Tech, Candiru and Bindecy did not respond to requests for comment from Citizen Lab or reporters.
Confiant’s CTO Jerome Dangu summed up the gap: the industry “has optimized against cyber criminals” but not against surveillance. Fraud filters look for mass malvertising; a campaign that serves its payload to a single device is designed to stay below that threshold.
What it means for US & EU software teams
For most companies the direct spyware risk is low — Candiru-class tools target journalists, officials and high-value staff. The broader lesson is architectural. Every ad SDK in an app and every ad tag on a site executes code chosen at auction time by parties you never contracted with. That is a supply-chain problem, and it should be handled like one: a known inventory of ad partners, sandboxed ad rendering and limits on what ad code can reach.
There is a privacy dimension too. The attack works because bid requests broadcast stable device identifiers and IP addresses at scale. In the EU, where regulators and courts have already scrutinised real-time bidding under GDPR, AdFection is likely to sharpen questions about which identifiers apps pass into the bid stream and on what consent basis. For enterprises, corporate phones and laptops used by executives, legal, security and government-facing staff are the obvious place to start reducing exposure.
What to do this week
- Inventory ad code. List every ad SDK, mediation adapter and ad tag in your apps and sites, with the exchanges and DSPs they reach.
- Sandbox ad slots. Render web ads in sandboxed iframes with a tight Content Security Policy; in apps, keep ad views isolated from authenticated web views and sensitive data.
- Trim identifiers. Do not pass advertising IDs, precise location or other stable identifiers into the bid stream unless the business case and consent basis are clear.
- Harden corporate devices. Through MDM, disable or reset mobile advertising IDs, block ad and tracking domains for high-risk users and keep browsers and OS patched.
- Review ad partners. Remove Discover-Tech-linked endpoints if present and add ad partners to your third-party risk process instead of trusting vendor certification lists.
Frequently asked questions
What is AdFection?
AdFection is the name Citizen Lab gave to a technique in which spyware is delivered through targeted online advertising. A seemingly normal ad carries a small script that reports the device advertising ID and IP address to a server; if the device matches a chosen target, the server returns JavaScript that can load a browser exploit. The victim does not need to click anything.
Who was behind the campaign?
According to Citizen Lab's October 15, 2026 report, the ads were bought through Controlium, a platform run by the Israeli company Discover-Tech. Citizen Lab linked at least 45 Al Jazeera devices targeted in 2024 and 2025 to Candiru spyware with high confidence and also tied the platform to the vendor Bindecy. The companies did not respond to reporters.
How big was the ad footprint?
Citizen Lab analysed nearly 4 billion ad bid records from March to June 2026. Discover-Tech ads were shown in 75,373 mobile apps and on 120,768 websites across 161 countries, including impressions on government and defence networks in Europe, the US and Australia.
What have the ad platforms done?
Google terminated Discover-Tech's access to its ad exchanges and IAB Europe removed it from its vendor list after the research was shared. Other ad tech companies named in the report either removed or paused the firm or had not responded by publication.
What should software teams do now?
Inventory the ad SDKs and ad tags in your apps and sites, sandbox ad slots, restrict what ad code can execute, and on corporate devices disable or reset mobile advertising IDs and block ad domains for high-risk staff. Treat ad partners as part of your software supply chain and review them like any other third-party code.
Sources
Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (October 15, 2026)
TechCrunch — Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware (October 15, 2026)
CyberScoop — AdFection: How mercenary spyware invades victims’ devices through targeted advertising (October 15, 2026)
The Record — Zero-click spyware infecting devices through online ads, researchers say (October 15, 2026)