Citizen Lab has confirmed the first known case of spyware installed through ordinary online ads, a technique it names AdFection. The Toronto research group’s report of 15 October 2026 traces AdFection spyware infections to at least 45 Al Jazeera computers in 2024 and 2025. Google has since cut off the adtech firm involved.
Citizen Lab is the digital-security research group at the University of Toronto’s Munk School. Its report, written by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, is numbered Report 195. “Mercenary spyware” means surveillance software built and sold commercially to government clients, rather than written by the buyer.
How AdFection Spyware Reaches a Device
AdFection works by turning the ad auction that loads with a web page into a delivery route. No click, no message and no download is involved, which is what “zero-click” means.
Citizen Lab describes the chain in four stages:
- Bid request: A page or app loads and broadcasts device details — advertising ID, cookie, IP address, location — to advertisers bidding for the slot.
- Target selection: Discover-Tech’s Controlium panel lets a client pick out one device from that stream by its advertising ID, cookie or IP address.
- Delivery: The winning ad carries attacker script that runs when the ad renders, reporting back on the device.
- Exploitation: If the device is selected, the server returns exploit code and installs the spyware silently.
Discover-Tech is an Israel-based company that presents itself as an ordinary advertising business and operates a demand-side platform called MyDSP. Citizen Lab concludes that bridging the ad industry and the spyware industry “appears” to be its primary purpose. The report also says Discover-Tech left source code exposed, which let researchers rebuild its control panel without logging in and download user login records tied to staff at two spyware vendors.
The real-time auction that makes this possible is not a flaw. It is how programmatic advertising has worked for years.
Who Was Infected and Who Was Only Profiled
The confirmed infection count is small and the exposure count is enormous, and the two numbers describe different things. Conflating them is the main error in circulation. Citizen Lab’s published figures keep them apart.
| Finding | Figure | Status |
|---|---|---|
| Al Jazeera devices infected with Candiru spyware | At least 45 Windows computers | Confirmed by Citizen Lab |
| Apps carrying ads with attacker script tags | 75,373 | Observed in bidding data |
| Websites carrying the same ads | 120,768 | Observed in bidding data |
| Ad bid records analysed | About 3.77 billion | March to June 2026 |
| Devices profiled as reconnaissance | “Millions”, per the report | Likely, not confirmed infected |
Citizen Lab’s own wording is that millions of devices “were likely unwittingly profiled” as preliminary reconnaissance. Profiling is not infection. The report is explicit that a Discover-Tech ad appearing on a screen does not mean that device was hacked.
Researchers also found the ads displayed on networks belonging to militaries, governments, critical infrastructure operators and national cyber agencies. Working with ad-quality firm Confiant, they saw potentially malicious ads served on networks of the International Atomic Energy Agency and the International Criminal Court. No infection was confirmed at any of those bodies.
The spyware traced to the Al Jazeera infections is Candiru, an Israeli vendor that Citizen Lab links with high confidence to a rebranded entity called Integrity Labs. A second vendor, Bindecy, also used the platform. This is the same category of commercial tooling as NSO Group’s Pegasus, delivered by a different route.
What the Ad Industry Did in Response
As of 16 October 2026, five ad companies have cut or suspended Discover-Tech’s access, all of them acting in early October before the report was published.
- Google: Terminated access to its ad exchanges, removed the firm from its vendor registry and deployed Safe Browsing protections against attacker-controlled domains.
- IAB Europe: Removed Discover-Tech from its vendor registry.
- Beeswax (FreeWheel/Comcast): Dropped the firm from its ad-buying platform.
- Vungle (Liftoff): Paused access pending a review.
- Eskimi: Blocked the company’s accounts and domains.
Google and IAB Europe had both listed Discover-Tech as an approved vendor since 2020. Discover-Tech, Candiru and Integrity Labs did not respond to requests for comment from Citizen Lab or from reporters. Bindecy, Intelos and Microsoft’s Xandr had not responded within the report’s timeline.
How to Reduce Exposure to Ad-Delivered Spyware
Citizen Lab publishes its own protection steps, and they are the only guidance here that comes from the researchers rather than from commentary. The report frames them for people at elevated risk “because of who you are or what you do”, such as journalists, activists and government staff.
- Get expert help: Anyone who believes they are a target should seek specialist assistance rather than self-diagnose.
- Install an ad blocker: Use an ad-blocking browser extension.
- Change browser: Consider a privacy-focused browser with stronger anti-tracking defaults.
- Reset the advertising ID: Reset your mobile advertising identifier and disable ad tracking.
- Block at the network: Use an ad-blocking service on your network, or a VPN that blocks ads.
For organisations, the report advises blocking ads and tracking at the gateway and on edge devices, opting devices out of ad targeting through mobile device management, moving to browsers with stronger anti-tracking features, and monitoring ad traffic for malicious requests. Its blunt assessment is that there is “currently no consistently safe way to expose your users and networks to targeted ads”.
What Citizen Lab Could Not Determine
Two significant questions are left open in the report itself.
First, attribution. Citizen Lab says it could not determine which governments were behind the attacks, only that the spyware involved is sold to government clients. Second, outcomes: for the billions of bid records it examined, the researchers cannot say whether any individual ad display led to a compromise.
Claims circulating that hundreds of millions of people were infected do not match the report. That framing appeared in at least one outlet’s headline; the report’s own confirmed infection figure is the 45 Al Jazeera devices. Similar caution applied when Apple warned users of mercenary spyware targeting — a warning of targeting is not proof of a successful hack.
Citizen Lab calls on regulators to investigate Discover-Tech and Candiru, and asks the ad industry to audit its approved-vendor registries. No regulator has announced an investigation as of 16 October 2026.
Frequently Asked Questions
What Is AdFection Spyware?
AdFection is Citizen Lab’s name for mercenary spyware delivered through targeted online ads. The code runs when the ad renders, so the target does not have to click anything.
How Many Devices Were Confirmed Infected?
At least 45 Windows computers at Al Jazeera, infected with Candiru spyware in 2024 and 2025. Citizen Lab confirmed no other infections in this report.
Were Millions of Phones Hacked?
No. Citizen Lab says millions of devices were likely profiled as reconnaissance, which is not the same as being infected. It found no evidence of infection beyond the Al Jazeera devices.
Is Discover-Tech Still Able to Buy Ads?
Google terminated its access to Google ad exchanges and removed it from its vendor registry in early October 2026. IAB Europe, Beeswax and Eskimi also cut it off, and Vungle paused access pending review.
Does an Ad Blocker Stop AdFection Spyware?
Citizen Lab lists an ad-blocking browser extension, a network-level ad blocker or an ad-blocking VPN among its recommended steps. It does not describe any single measure as complete protection.
