Online advertising has become an unexpected delivery system for mercenary spyware. In a new investigation, the University of Toronto’s Citizen Lab details “AdFection,” a technique that can compromise phones and computers when a targeted ad is merely displayed—without requiring the victim to click a link, download a file, or open an attachment. The findings, first reported by Engadget, represent the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising.
Citizen Lab traced the campaign to attacks against at least 45 devices belonging to Al Jazeera journalists and staff during 2024 and 2025. The researchers linked the infections with high confidence to spyware attributed to Candiru, an Israeli mercenary surveillance company that has also operated under the name Integrity Labs. The ads were purchased through Discover-Tech, an Israeli company that presented itself as a conventional advertising provider but, according to the report, functioned as a bridge between the ad-tech industry and spyware and intelligence vendors.
The mechanism exploits the ordinary complexity of modern ad delivery. A banner can contain HTML, JavaScript, tracking pixels, and invisible frames supplied by multiple vendors. When the ad renders inside an app or browser, it can automatically contact a Discover-Tech server with information such as an advertising identifier, IP address, browser details, and device characteristics. The server can then decide whether the device matches a selected target. Non-targets may receive an empty response, while a chosen device can receive additional JavaScript capable of loading a browser exploit and spyware.
That targeting infrastructure operated at striking scale. Citizen Lab analyzed nearly four billion Discover-Tech bidding records from March through June 2026, including bids associated with more than 70,000 mobile apps and 120,000 websites. Roughly 19 percent of the bids appeared to involve ads containing scripts pointing to servers used for dynamic code delivery, and the impressions reached users in 161 countries. The researchers stress that seeing one of these ads does not, by itself, prove a device was infected; it does show that the advertising system could profile users and potentially execute code on their devices.
The investigation also illustrates why the threat is difficult to contain. Discover-Tech’s platforms interacted with major advertising infrastructure, including Google, Yandex, Vungle, Beeswax, Eskimi, and Microsoft’s Xandr identity systems. Citizen Lab says Google removed Discover-Tech from its ad registries and terminated its exchange access in early October 2026, while IAB Europe removed the company from its Global Vendor List on October 8. Other intermediaries paused campaigns, blocked accounts, or began reviews after being contacted by researchers.
For ordinary users, AdFection is a reminder that “don’t click suspicious links” is no longer a complete security strategy. Citizen Lab recommends blocking targeted advertising and tracking at the browser, device, or network gateway level, disabling mobile advertising IDs, and using privacy-focused browsers with reputable content blocking. Its broader warning is aimed at the industry: real-time bidding and identity-sharing systems can give poorly vetted vendors access to enormous audiences, including people on government, media, defense, and critical-infrastructure networks. The next phase of the story will likely involve determining which customers commissioned these capabilities, how many infections occurred beyond Al Jazeera, and whether regulators treat malicious ad delivery as an advertising problem, a spyware problem, or both.
