AdFection: spyware delivered just by showing an ad — 442 million impressions across 75,000 apps
The University of Toronto's Citizen Lab said on October 15, 2026 that Israeli adtech company Discover-Tech used targeted advertising as a zero-click delivery channel for mercenary spyware, a technique it named AdFection. From March to June 2026 the firm's MyDSP platform bid on 3.77 billion ad impressions and won about 442 million, appearing on 120,768 websites and 75,373 apps. At least 45 Al Jazeera devices were targeted with Candiru spyware. Seeing one of the ads does not mean a device was infected.
The three lines
- Finding — first public confirmation of zero-click spyware via targeted ads; 45 Al Jazeera devices
- Scale — Mar-Jun 2026: 3.77B bids, ~442M wins, 120,768 websites and 75,373 apps
- Response — Google and IAB Europe removed the firm; researchers advise limiting ad tracking or blocking ads
Key questions
- What is AdFection spyware
- **A technique that abuses ad auctions to send malicious code only to chosen devices.** | Item | Detail | |---|---| | Name | AdFection (ad + infection) | | Published | Citizen Lab, October 15, 2026 | | Company | Discover-Tech (Israel); platforms Controlium and MyDSP | | Partners named | Candiru (now Integrity Labs), Intelos, Bindecy | | Confirmed targets | At least 45 Al Jazeera devices (2024-2025) | | Trait | Zero-click: triggers when the ad renders |
- Can you get spyware from seeing an ad
- **Only targeted devices received malicious code; an impression alone does not mean infection.** | Number | Meaning | |---|---| | 3.77 billion | Impressions Discover-Tech bid on | | 441.9 million (11.7%) | Impressions won | | 718.7 million+ (~19%) | Bids carrying attacker script tags | | 45 | Al Jazeera devices confirmed targeted |
- How to protect against ad-based spyware
- **Researchers recommend disabling ad tracking or blocking ads.** | Step | How | |---|---| | Disable ad ID | iPhone: Settings > Privacy & Security > Tracking off; Android: Settings > Privacy > Ads > Delete advertising ID | | Block ads | Browser ad-blocking extensions or content blockers | | High-risk users | iPhone Lockdown Mode; Android Advanced Protection | | Everyone | Keep OS and browser updated |
For the first time, researchers have publicly confirmed that a phone can be targeted with spyware simply because an ad loaded on its screen — no click required. In a report published October 15, 2026, the University of Toronto's Citizen Lab said Israeli adtech firm Discover-Tech turned targeted advertising into a delivery pipeline for government-grade "mercenary" spyware. The researchers named the technique AdFection.
Senior researcher Bill Marczak told the Financial Times the company had turned trusted sites and popular apps into a "zero-click spyware delivery platform," adding that the discovery is "surely just the tip of the iceberg." Google, which investigated jointly with Citizen Lab and ad-security firm Confiant, has cut the company off.
1. How it works — weaponizing the ad auction
When a page or app loads, its ad slot is sold in an automated auction lasting a fraction of a second — real-time bidding (RTB). Bidders receive details such as the device's advertising ID, IP address and device type. Our RTB explainer covers the mechanics.
Discover-Tech's Controlium platform let customers target a specific person by advertising ID, browser cookie ID or IP address. When that person's ad slot came up for auction, the platform bid, and when the ad rendered, a server called NOAS returned malicious JavaScript only to the target. Exchanges saw an ordinary ad and had nothing to filter.
2. The numbers
| Item | Figure (Mar-Jun 2026, Citizen Lab) |
|---|---|
| Impressions bid on | ~3.77 billion |
| Impressions won | ~441.9 million (11.7%) |
| Mobile apps / web | 76.7% / 23.3% |
| Bids with attacker script tags | 718.7 million+ (~19%) |
| Where ads ran | 75,373 apps, 120,768 websites |
| Recorded spend | ~$109,091, zero revenue or conversions |
| Confirmed targets | At least 45 Al Jazeera devices (2024-2025, Candiru spyware) |
Over 400 million impressions for about $109,000 with no conversions means these were not real advertisers' campaigns. Ads also reached government, military, critical-infrastructure and media networks, including NATO and UN networks. Citizen Lab stresses that an impression is not an infection: most served to profile who was where, with infection attempts reserved for selected devices. A login flaw left the firm's access logs exposed for 128 days — including details of Candiru employees.
3. Industry response and what individuals can do
| Party | Action |
|---|---|
| Removed from global vendor list; exchange access cut | |
| IAB Europe | Removed from vendor registry (early October) |
| Beeswax | Removed |
| Vungle | Access paused |
| Eskimi | Accounts blocked |
| Citizen Lab | Urged regulators to investigate Discover-Tech and Candiru |
Marczak's advice is to disable ad tracking on devices or block ads altogether. Targeting depends on the advertising ID; deleting it weakens the link. Journalists, activists and officials should consider iPhone Lockdown Mode or Android's Advanced Protection. AdFection effectively turns the ad supply chain into an attack supply chain — a cousin of the software supply-chain attacks we covered earlier.
4. What remains open
- Victims: confirmed targeting is limited to 45 Al Jazeera devices.
- Korea: whether South Korean users were targeted is not clear from the excerpts we reviewed.
- Follow-up: Citizen Lab plans a report on a separate actor, DARK CARTOGRAPHER, that linked ad IDs to phone numbers.
- Companies: Discover-Tech and partners have not commented.
Sources
- Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
- Engadget — Citizen Lab details new spyware triggered by online advertising
- The Register — Spyware vendors found a way to make targeted ads even worse
- Security Affairs — AdFection: Citizen Lab Exposes Ad-Delivered Spyware Networks