Zero-click spyware delivered via online ads: Citizen Lab details the 'AdFection' campaign
Citizen Lab's AdFection report gives the first technical proof of zero-click spyware by targeted ads: 45 Al Jazeera devices hit, attack scripts in 75,373 apps.
Citizen Lab at the University of Toronto published Report 195, “Exposing AdFection,” on October 15, and it carries the first technical proof that a targeted ad can serve as a zero-click delivery vehicle for mercenary spyware. The lab ties at least 45 Al Jazeera devices infected during 2024–2025 to the ad pipeline of Discover-Tech, an Israeli adtech firm whose Controlium platform can de-anonymize a device, fingerprint it and deliver an attack payload at the moment an ad renders. Google and IAB Europe removed Discover-Tech from their vendor lists in early October.
Key points
- Between March and June 2026, ads carrying an attack script (a NOAS tag) were displayed across 75,373 Android/iOS apps and 120,768 websites, reaching IPs in 161 countries (Citizen Lab Report 195, October 15, 2026).
- Al Jazeera network logs establish the zero-click chain: contact with Discover-Tech ad infrastructure → a Candiru validation server → a Candiru C2 server. Malware samples link to Candiru with high confidence, and about 3.6 million users were steered to Candiru infrastructure for profiling from January to June 2026.
- Google cut Discover-Tech’s access to its ad platforms, IAB Europe struck it from the Global Vendor List, Beeswax removed it, and Vungle paused it pending review.
Background
Candiru is an Israeli mercenary spyware vendor that the US Commerce Department placed on the Entity List in 2021. Citizen Lab’s report describes the operation as rebranded “Integrity Labs”; Wired words it as Candiru’s assets being “believed” to sit with Integrity Partners. This piece follows the primary source. Spyware over ads had been suspected before: Amnesty International’s December 2025 report on Intellexa pointed in that direction, and CyberScoop’s assessment is that earlier reporting stopped at hints — AdFection is the first campaign documented end to end. Al Jazeera took part in the investigation and shared device logs with Citizen Lab.
The facts
| Metric | Figure | Window | Source |
|---|---|---|---|
| Ads with attack script shown | 75,373 apps, 120,768 websites | March–June 2026 | Citizen Lab |
| MyDSP bids / wins / spend | 3.77 billion / 442 million (11.7%) / ~$109,091 | March–June 2026 | Citizen Lab |
| Users steered to Candiru infrastructure | ~3.6 million | January–June 2026 | Citizen Lab |
| Al Jazeera devices infected | at least 45 | 2024–2025 | Citizen Lab |
| Government networks that saw the ads | 24 countries | as of October 15, 2026 | Citizen Lab |
| Discover-Tech daily delivery | ~10 million impressions, 228 countries | reported October 2026 | Confiant |
The bid records are the backbone of the evidence. Discover-Tech’s DSP, MyDSP, bid on 3.77 billion auctions between March and June 2026, won 442 million of them (an 11.7% win rate) and spent about $109,091; roughly 19% of those bids — 718.7 million — carried the NOAS attack-script tag. Small money bought enormous reach: ads landed on IPs in 161 countries, including networks run by NATO, the UN, the European Parliament, the European Commission and the Council of the EU’s General Secretariat, plus government networks in 24 countries — among them the defense ministries of Israel and Italy, election bodies in Armenia, Indonesia and Mexico, corporate networks at Intel, Nvidia, Raytheon and Elbit, and media organizations in 8 countries. Confiant, which published a co-timed joint investigation, separately confirmed impressions on US Department of Defense and IAEA networks.
The profiling funnel upstream has its own numbers. Confiant’s independent measurement puts Discover-Tech at roughly 10 million impressions a day across 228 countries, about 60% of them affiliate placements; its SDK siphons first-party cookies from more than 1,000 publisher domains — session tokens included, with EU users in the pool without GDPR consent — sets up an ECDH-encrypted C2 channel, and can execute pushed code through new Function(...). The hand-offs to Candiru were small: a few hundred to a few thousand impressions a day, concentrated in 9 countries with Belgium at 56%. Palestine was the most-targeted geography overall: across the measurement window of April 1 to September 10, 2026, one in 36 Android ads in Palestine was served by Discover-Tech, and on April 7 the company accounted for a peak of 9.9% of all ads there.
The report draws its own boundary: an ad impression on a network does not, by itself, confirm that anyone on it was targeted or infected. The 75,373 apps and 120,768 sites measure the attack surface; the zero-click evidence comes from Al Jazeera’s network logs and malware analysis. One supporting detail from Report 195: an encrypted q= parameter in a VirusTotal infection link decrypted to an IP registered to Saudi Arabia’s Ministry of Foreign Affairs — recorded as a likely target.
What others say
Bill Marczak, senior researcher at Citizen Lab: “AdFection allows operators to automatically hack specific individuals with mercenary spyware.” He added that the ad ecosystem’s targeting ability is a strong fit for the mercenary spyware industry, and that the scarcity of earlier reporting likely reflects visibility. His colleague Wolfie Christl called ad-borne infection a “nightmare scenario” and told CyberScoop “digital advertising is broken.” Confiant co-founder and CTO Jerome Dangu was more specific: adtech defenses are optimized “against cyber criminals, scams and malware for profit,” with no equivalent built for surveillance. On the industry side, Jason Kint, CEO of the US digital publishers’ association Digital Content Next, told Wired he would not be surprised by zero-click ad attacks and that anything eroding trust in the open web concerns him. Discover-Tech, its CEO Dekel Boni, Candiru (Integrity Labs), Bindecy and Intelos did not respond to comment requests before publication.
Our take
AdFection changes what the attack surface means. Any app or media site that runs an ad SDK sits inside the delivery network, with no mistake on its part required. We covered how far real-time bidding can carry personal data when Norway fined Microsoft’s Xandr the equivalent of €8.5 million over Grindr data; AdFection pushes that same pipeline from data leakage to payload delivery, at no point needing the user’s cooperation. On defense, the researchers are blunt: thorough ad blocking is close to the only reliable protection, and Wired reports the NSA and CIA use ad blockers internally. The theme of an industry building its defenses in the wrong place came up earlier this month in our piece on AI agent incidents. What remains unknown: who the customers are (Citizen Lab could not attribute the attacks to any buyer), how many devices were actually infected, and whether the ad industry will fix anything structural beyond individual expulsions.
What to watch
- IAB Europe says a confirmed spyware role could justify a “definitive expulsion” of Discover-Tech; Vungle (Liftoff) has paused access pending review.
- CyberScoop flags a follow-up: a separate actor, DARK CARTOGRAPHER, has used Discover-Tech infrastructure since 2019 to exploit carrier vulnerabilities and link advertising IDs to phone numbers across more than 30 countries; a dedicated report is coming.
- Intelos, Bindecy and Microsoft’s Xandr had not responded to inquiries as of October 15, 2026.