AdFection: Spyware Delivered via Targeted Ads

Citizen Lab researchers published Report 195 on October 15, 2026, documenting what they call AdFection — the first publicly confirmed technique for delivering zero-click mercenary spyware through targeted online advertisements. The malicious ads were purchased by Discover-Tech, an Israeli firm that presents itself as a legitimate ad company but operates as an infrastructure provider for multiple mercenary surveillance vendors. Discover-Tech's platform, Controlium, allows its spyware partners to fingerprint, de-anonymize, and silently infect a device the moment an ad renders — requiring zero interaction from the target. Al Jazeera devices were specifically infected with Candiru spyware, rebranded as "Integrity Labs." Analysis of four billion Discover-Tech bidding records over a four-month window shows its ads appeared on nearly 200,000 unique websites and mobile apps across dozens of countries. Millions of devices were covertly redirected to contact Candiru's servers, likely for tracking and reconnaissance. Discover-Tech is also linked to other threat actors, including Intelos and Bindecy. A separate actor, dubbed DARK CARTOGRAPHER, exploited mobile carrier vulnerabilities through Discover-Tech's infrastructure to link advertising IDs to phone numbers, mass-deanonymizing internet users. The six-author team, led by Bill Marczak and Ron Deibert, calls online advertising "a cybersecurity and privacy crisis."