# AdFection: How Targeted Ads Delivered Spyware, per Citizen Lab
> Citizen Lab's Oct. 15, 2026 report links Candiru spyware at Al Jazeera to Discover-Tech ads. How the ad chain worked, who cut it off, and what is unconfirmed.
**TL;DR**
- Citizen Lab's Oct. 15, 2026 report says it finds "with high confidence" that Al Jazeera devices were infected with Candiru spyware delivered through targeted ads bought by Israeli firm Discover-Tech; at least 45 devices were targeted in 2024–2025. The lab calls the technique AdFection.
- In the chain it describes, the ad carries no exploit. A script in the ad calls a Discover-Tech server that returns code only to selected devices.
- Google and IAB Europe dropped Discover-Tech from their vendor lists in early October 2026. For the Al Jazeera infections, the report does not identify the exploit or a patch, and it names no government behind the attacks.
## What did Citizen Lab find?
The University of Toronto lab's report, "Exposing AdFection," calls itself the first public technical confirmation of zero-click mercenary spyware delivered via targeted ads. Zero-click means the target taps nothing; per the report, its research indicates that the display of a targeted ad is enough.
Its main findings:
- **Al Jazeera:** a series of 2024–2025 zero-click attacks that Citizen Lab links "with high confidence" to Candiru spyware delivered through Discover-Tech ads, with at least 45 devices targeted.
- **Discover-Tech:** an Israeli company that, the report says, presents itself as an ad firm but operates as a facilitator for several spyware partners.
- **Other partners:** links to spyware firm Bindecy and to Intelos, an ad-based intelligence (ADINT) vendor.
- **Mass profiling:** Discover-Tech ads covertly directed millions of devices to contact Candiru's servers, "likely" for tracking and reconnaissance.
Candiru was added to the U.S. Commerce Department's Entity List on Nov. 3, 2021. The report says it now operates as Integrity Labs after an acquisition by U.S.-based Integrity Partners, reported in April 2025, whose current status is unclear.
## How did the ad-delivered infection work?
Per Citizen Lab, Discover-Tech wins a real-time ad auction and its ad is pushed to an app or site open on the device, in some cases rendering in the background. Many of its ads carry a script tag pointing to a Discover-Tech "NOAS server," which receives the user's cookie ID or mobile ad ID.
The server decides, apparently from the IP address and those identifiers, whether the device is eligible. If it is, JavaScript comes back and the browser or app runs it; the executive summary says that code then exploits and infects the device. If not, the reply is empty (0 bytes). Even then, the ad gathers browser data for Discover-Tech, which can include page cookies and the device's public IPv6 address.
The AdFection delivery path as Citizen Lab describes it. Source: Citizen Lab, "Exposing AdFection," Oct. 15, 2026.
The report says this let Discover-Tech avoid directly sharing malicious code, or links to it, with the companies serving the ads. Eskimi told Citizen Lab the tags "were built to evade automated scanning," loading different code by device, IP address and location. Controlium, a Discover-Tech platform, lets customers select a user for infection or profiling by iOS or Android ad ID, cookie ID or IP address.
## What evidence ties the attacks to Candiru?
- **Network logs from Al Jazeera.** Infected devices first reached Discover-Tech domains (an ad impression), then a Candiru "validator" server, then a Candiru command-and-control server.
- **Server fingerprints.** Searches of Censys scan data matched 305 validator domains on 319 IP addresses from August 2022 to July 2026, including domains Sekoia and Recorded Future had tied to Candiru.
- **The sample.** Al Jazeera isolated a Windows DLL from one compromised device. Shared traits with the Candiru chain Citizen Lab captured in 2021, including the persistence method and a 48-byte repeating-XOR obfuscation technique, led the lab to "conclude with high confidence" it is a newer version.
- **Discover-Tech's exposed systems.** Controlium's front-end code sat on its login page, and an open endpoint returned 128 days of login logs with 120 usernames, including two from an Israeli IP address the lab attributes to Candiru/Integrity Labs.
## How far did the ads reach?
Citizen Lab analyzed nearly four billion bidding records that a Discover-Tech server left world-readable, covering March through June 2026.
MyDSP bidding records, March to June 2026; app and website counts cover displayed ads with attacker script tags. Source: Citizen Lab, "Exposing AdFection," Oct. 15, 2026.
MyDSP, Discover-Tech's buying platform, bid on 3,770,286,576 impressions; it appeared to have won 441,954,291 of them (11.7%). At least 718,748,885 bids, about 19%, were for ads that apparently carried a NOAS script tag; such ads were displayed in 75,373 apps and on 120,768 websites. Yandex accounted for 67.4% of bids, Google Ad Manager 24.74% and Vungle 7.24%. The executive summary says the lab "found no evidence" of legitimate advertising activity.
Impressions appeared on NATO, UN and EU institution networks and government networks in 24 listed countries (SignalStack count). The report stresses that an impression "does not in and of itself confirm targeting or infection." Confiant, an ad-security firm whose report starts with an ad its scanner flagged on April 12, 2026, reported signs of the ads on U.S. Department of Defense, IAEA and International Criminal Court networks, per Citizen Lab.
## Who has cut Discover-Tech off?
From vendor listings in 2020 to removals in October 2026. Source: Citizen Lab (Oct. 15, 2026); Confiant (Oct. 15, 2026).
| Company | Action, per Citizen Lab or the company |
|---|---|
| Google | Removed it from vendor lists and ended ad-exchange access in the first week of October; said, per Reuters, it removed Discover-Tech "for systematically violating our policies" |
| IAB Europe | Removed it from the Global Vendor List on Oct. 8; said, per Reuters, the suspension followed an audit that identified policy violations |
| Beeswax (Comcast) | Removed it from its Buyer Cloud platform |
| Vungle (Liftoff) | Paused all access while it conducts its own review |
| Eskimi | Blocked its accounts and domains; says Discover-Tech's last campaign on its DSP was stopped on Aug. 6 |
Of 13 companies Citizen Lab contacted, eight, including Discover-Tech, Candiru and Bindecy, did not reply in time. Adtimizer and Volasim, which the report links to Discover-Tech, denied involvement; the report says it has no conclusive evidence they knowingly took part.
## Background
Discover-Tech Ltd was registered in Israel in March 2020, with Dekel Boni, who lists himself as CEO, as first director. IAB Europe listed it from July 2, 2020 and Google from 2020, listings the report says made it look legitimate. Eric Banoun, described in the report as a co-founder of surveillance firms Circles and Senpai Technologies, was on its board from 2020 until January 2025.
Earlier Candiru research cited in the report includes two zero-days identified after Citizen Lab and Microsoft analyzed Candiru spyware in 2021 (CVE-2021-31979, CVE-2021-33771) and a Chrome WebRTC zero-day Avast reported in 2022 (CVE-2022-2294); the new report does not tie them to AdFection. Related: the [Ledger hardware wallet implant](/blog/ledger-hardware-wallet-spy-chip-implant-what-ledger-says/), the [Brevo supply-chain attack](/blog/brevo-supply-chain-attack-cloudflare-api-key/) and [Tech & Security](/category/tech-security/).
## What can users and organizations do?
Citizen Lab's advice for individuals: seek expert help if you face elevated risk; use a trusted ad blocker and a privacy-respecting browser; regularly reset your mobile advertising ID and turn off ad tracking.
For organizations, it recommends blocking ads at the gateway and on work devices, opting company-issued devices out of ad targeting, and monitoring traffic tied to ad impressions. It urges news organizations to review their logs, and notes the NSA and CISA recommended ad-blocking in 2018 and 2020.
## What could go right
- Google told Citizen Lab it deployed Safe Browsing warnings for users who may reach known actor-controlled domains; Eskimi says it shared technical indicators with supply partners.
- The report lists Discover-Tech domains in an appendix and says defenders can directly block its current methods by blocking advertising identifiers, though the attack surface may be larger.
## What could go wrong
- For the Al Jazeera attacks, the report does not identify the exploited vulnerability, a patch, or an affected browser version; its one sample is a Windows DLL. Confiant says it has "not captured a full exploit chain in the wild."
- Per TechCrunch, Citizen Lab said it was unclear which governments were behind the attacks.
- Reuters (45 compromised) and TechCrunch (at least 45 affected) cite Windows devices; the report says at least 45 were targeted, without an infected count.
- Citizen Lab's Bill Marczak said Discover-Tech is "surely just the tip of the iceberg," per TechCrunch.
## FAQ
Q What is AdFection?
A Citizen Lab's name, in its Oct. 15, 2026 report, for zero-click spyware delivered through targeted online ads.
Q Was Al Jazeera hacked with spyware through ads?
A Citizen Lab says it finds "with high confidence" that Al Jazeera devices were targeted and infected with Candiru spyware via Discover-Tech ads in 2024 and 2025, with at least 45 devices targeted.
Q Can you get spyware just by seeing an ad?
A In the chain Citizen Lab documented, selected targets could: the ad called a Discover-Tech server that sent code only to chosen devices. Others got an empty reply.
Q What is Discover-Tech?
A An Israeli company founded in 2020 that, per Citizen Lab, acts as a bridge between spyware vendors such as Candiru and the ad industry. Google and IAB Europe dropped it in early October 2026.
Q How can I protect myself from AdFection?
A Citizen Lab recommends ad-blocking, a tracking-blocking browser, regularly resetting your mobile advertising ID and turning off ad tracking.
