Citizen Lab, the University of Toronto’s internet research lab, published a report on October 15, 2026, describing what it calls the first confirmed case of mercenary spyware delivered through ordinary online advertising, with no click, download, or file ever required. The report, titled “How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware,” names an Israeli advertising company, a spyware technique it has dubbed “AdFection,” and two spyware vendors tied to past surveillance scandals. The story was first reported by Engadget and quickly picked up by outlets including TechCrunch.
For an industry that already has a documented case of 45 Al Jazeera devices targeted through this exact pipeline, the bigger story on October 15 is the mechanism itself: a widely used advertising network, embedded in tens of thousands of ordinary apps and websites, apparently repurposed as a spyware delivery rail. That shifts the conversation from “who got hacked” to “how exposed is everyone who simply opened an app with ads running in the background.”
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Citizen Lab’s AdFection Report Actually Says
According to Citizen Lab’s report, the technique it named AdFection works by exploiting the targeted-advertising supply chain rather than a messaging app or a malicious attachment. Citizen Lab describes the finding as “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” a framing that distinguishes AdFection from earlier spyware scandals built around one-click links or messaging-app exploits. The report states that the attacks could occur the moment an advertisement was rendered on a device, without the target tapping a link, opening a file, or taking any action at all.
That detail is what has security researchers alarmed. Previous mercenary spyware campaigns, including those tied to NSO Group’s Pegasus, generally required some interaction from the victim, or exploited a single messaging channel such as iMessage or WhatsApp. An advertising-based pipeline is different in kind: it rides on an entire ecosystem of programmatic ad exchanges, publisher inventory, and real-time bidding systems that were never designed with spyware delivery in mind. Citizen Lab’s report frames the discovery as evidence that the advertising pipeline itself, not just a messaging app or an operating system bug, can now be treated as a viable mercenary spyware distribution channel.
Discover-Tech and Controlium: The Company at the Center
Citizen Lab identifies Discover-Tech as an Israeli company whose advertising platform, called Controlium, was used to target devices with spyware. The Register, which reviewed the report, quoted Citizen Lab’s characterization directly: “We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse,” according to the report as covered by The Register.
That framing matters because Discover-Tech, on paper, looked like any other ad-tech vendor plugging into the same auction systems that serve banner ads, in-app interstitials, and native placements across the open web. Citizen Lab’s research suggests Controlium was not simply carrying malicious creative assets that slipped past a review process; the platform itself allegedly functioned as the mechanism for identifying and routing spyware payloads to specific targets, folded inside what otherwise looked like routine ad traffic. Citizen Lab senior researcher Bill Marczak put it directly: “Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform,” a statement quoted in reporting that followed the report’s release.
Neither Citizen Lab’s published material nor the coverage that followed discloses Discover-Tech’s financial relationship with advertisers, its revenue, or a licensing price for Controlium. Readers should treat any specific dollar figure attached to Discover-Tech or Controlium circulating elsewhere as unconfirmed until Citizen Lab or Discover-Tech itself publishes those details.
Candiru and Bindecy: The Spyware Makers Behind the Payloads
Citizen Lab ties the AdFection delivery chain to two spyware developers: Candiru and Bindecy. Candiru is a name security researchers have tracked for years as a commercial spyware vendor whose tools have surfaced in previous mercenary surveillance investigations; Bindecy is named alongside it in the new report as a second vendor linked to the campaign. The report does not specify a contractual relationship between Discover-Tech, Candiru, and Bindecy beyond the technical evidence that Candiru-attributed spyware was delivered through the Controlium advertising pipeline onto devices associated with Al Jazeera.
In Citizen Lab’s own words, drawn from the report’s executive summary: “We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware.” That single sentence captures the structural shift this report documents: a named commercial spyware vendor whose tools have previously been found on journalists’ phones, now linked to a delivery system built on top of ordinary programmatic advertising rather than a bespoke exploit chain.
The Al Jazeera Targeting: What’s Confirmed and What Isn’t
Citizen Lab’s report documents at least 45 devices associated with Al Jazeera that were targeted using Candiru spyware delivered through the Discover-Tech pipeline, with infections occurring across 2024 and 2025, according to reporting that reviewed the findings. That number represents confirmed, documented cases tied to one newsroom; it is not a claim about the total number of people exposed globally, which Citizen Lab has not disclosed. Readers following the broader privacy-and-surveillance beat may also recall the ongoing debate over always-on AI wearables and what they capture, a separate story but part of the same wider conversation about how much consumer technology now operates as a surveillance surface by default.
Citizen Lab has not named which governments or state actors commissioned the targeting of Al Jazeera devices. That detail remains unconfirmed, and any claim naming a specific government as the customer behind this campaign should be treated as speculation rather than established fact until Citizen Lab or an independent investigation says otherwise.
The Scale Problem: Tens of Thousands of Apps and Websites
What separates this report from a narrow, targeted-surveillance story is the scale of the advertising network involved. Citizen Lab’s report states that Discover-Tech ads appeared in more than 70,000 mobile apps and more than 120,000 websites between March and June 2026. In Citizen Lab’s own words, quoted directly in coverage: “We found that Discover-Tech ads were displayed in over 70,000 mobile apps, and over 120,000 websites between March and June 2026.” Separately, one report put the volume of ad impressions at 442 million displayed across more than 120,000 websites, a figure that describes overall ad volume on the network rather than a count of malicious or targeted impressions specifically.
It is important to be precise about what that scale does and does not mean. Citizen Lab’s report does not state that every ad served through Discover-Tech’s network was malicious, nor that every one of the 70,000-plus apps or 120,000-plus websites delivered spyware to users. The documented spyware infections are tied to a specific, targeted set of devices connected to Al Jazeera. What the scale figures establish is the size of the advertising footprint that a spyware operator could, in theory, use to selectively target specific devices while blending into a much larger stream of ordinary ad traffic.
How Targeted-Ad Spyware Delivery Actually Works
Programmatic advertising runs on real-time bidding: when a user opens an app or a webpage, an auction happens in milliseconds among ad networks competing to place a creative in that slot, based on signals like device type, rough location, and inferred interests. That system was built to let advertisers target audiences at scale, and it depends on granular device- and session-level targeting data flowing between ad exchanges, demand-side platforms, and publishers.
Citizen Lab’s report describes a technique that uses this exact targeting infrastructure for a different purpose: instead of routing a product ad to a likely buyer, the system can route a spyware payload to a specific device identified as a target, rendered the moment the ad slot loads. Because the delivery happens inside an advertisement rather than a link, message, or file, there is no attachment to avoid opening, no suspicious link to avoid tapping, and in principle no user behavior that would have prevented the infection. That is what Citizen Lab means by “zero-click”: the entire chain of events that used to require a victim’s mistake now requires only that an ad loads normally, the way ads load on every phone, every day, across apps people already trust.
Historical Context: From Pegasus Links to Ad-Based Delivery
Citizen Lab has spent roughly a decade documenting the evolution of mercenary spyware delivery methods, and the lab’s own research record provides the clearest baseline for understanding how significant this shift is. Early commercial spyware campaigns tied to NSO Group’s Pegasus relied on one-click links sent via SMS or messaging apps, requiring a target to tap something. By the early 2020s, Citizen Lab and partner researchers had documented zero-click exploits delivered through specific messaging channels, including iMessage, that infected a device without any tap at all, but those exploits still depended on a single messaging app’s processing pipeline and a specific software vulnerability that could eventually be patched.
AdFection, as described in Wednesday’s report, represents a different category of risk because it does not depend on a single messaging app or a single software bug. It depends on the targeted-advertising ecosystem, which is deliberately designed to be pervasive, cross-platform, and difficult for any one company to fully audit, since ad inventory gets resold and re-brokered across dozens of intermediaries before it reaches a device. Wired’s coverage of the report frames it as a scenario security researchers have worried about for years without being able to prove: that the ad-tech supply chain, not just app stores or messaging platforms, could become a spyware delivery mechanism in its own right.
Mercenary Spyware Delivery Methods Compared
| Delivery Method | User Action Required | Primary Channel | Public Disclosure |
|---|---|---|---|
| One-click malicious link | Target taps a link | SMS / messaging app | Multiple Citizen Lab Pegasus investigations, mid-2010s onward |
| Zero-click messaging exploit | None; message need only be received | Single messaging app (e.g., iMessage) | Citizen Lab and partner research, early 2020s |
| Zero-click ad delivery (AdFection) | None; ad need only render | Programmatic ad networks across apps and websites | Citizen Lab’s Discover-Tech report, October 15, 2026 |
Market Impact: A Credibility Problem for Programmatic Advertising
The immediate fallout from this report is not limited to the spyware industry. Programmatic advertising already operates under intense scrutiny over ad fraud, data brokering, and opaque supply chains; a documented case of a spyware vendor allegedly using the exact same auction and targeting infrastructure to deliver surveillance tools adds a new category of risk that advertisers, publishers, and app developers did not previously have to account for. Every app and website that carried Discover-Tech inventory between March and June 2026, whether or not any of its users were ever targeted, now has to answer questions from its own advertising partners and, potentially, its users about how its ad-serving relationships are vetted.
For ad exchanges and supply-side platforms, the report raises a harder operational question than a single bad actor being removed from a network. If a legitimate-looking advertising company can function as a spyware delivery platform without its publisher partners detecting it across 120,000-plus websites for months, the vetting processes that the industry relies on to keep malicious actors out of real-time bidding auctions did not catch this one. That is a credibility problem that extends well beyond Discover-Tech itself, and it is likely to accelerate calls for mandatory security audits of ad-tech vendors that sit inside app SDKs and website ad tags.
Spyware-via-Advertising: The Numbers That Matter
| Metric | Figure | Period / Source |
|---|---|---|
| Apps carrying Discover-Tech ads | 70,000+ | MarchâJune 2026, per Citizen Lab |
| Websites carrying Discover-Tech ads | 120,000+ | MarchâJune 2026, per Citizen Lab |
| Ad impressions on the network (one report) | 442 million | Reported across 120,000+ websites |
| Al Jazeera devices confirmed targeted | 45 | 2024â2025, per Citizen Lab |
| Spyware vendors named in the report | 2 (Candiru, Bindecy) | Citizen Lab’s October 15, 2026 report |
Competitive Comparison: How Ad-Tech Security Vetting Stacks Up
Ad exchanges and demand-side platforms generally run automated creative scanning designed to catch malware hidden in ad assets, along with brand-safety filters meant to block adult content, misinformation, or malicious redirects. Those systems were not built to catch a vendor using legitimate-looking targeting infrastructure to selectively route a payload to a small number of specific devices while the rest of its traffic behaves normally. That is precisely the gap AdFection appears to have exploited: automated review tools are tuned to catch patterns that show up at scale, such as a malicious ad unit firing the same exploit at every viewer, not a system engineered to activate only against a handful of pre-identified targets.
This is also where the comparison with mobile operating system security becomes relevant. Apple and Google have spent years hardening iOS and Android against one-click and zero-click exploits delivered through messaging apps, including the kind of iMessage-based attacks Citizen Lab has previously documented. Advertising SDKs embedded inside apps operate with a different trust model: once an app includes an ad SDK, that SDK can often render content and collect device signals with a level of access the app’s own developer may not fully audit, let alone the platform on which the app runs. Zero-day flaws affecting enterprise security appliances, such as the PAN-OS vulnerability patched earlier this year or the FortiMail zero-day added to CISA’s Known Exploited Vulnerabilities list, at least get tracked through a formal disclosure and patching pipeline. Ad-tech vendors operating inside that same threat landscape have no equivalent mandatory disclosure process.
Expert and Industry Reaction
Citizen Lab’s own language in the report is unusually direct for a security disclosure. The lab’s description of the finding as “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads” signals that researchers view this less as an isolated incident and more as proof of a delivery category that defenders now have to plan around. Citizen Lab senior researcher Bill Marczak’s assessment, that “Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform,” as reported by Engadget, points to a pattern of activity rather than a single incident.
That characterization, that Discover-Tech “appears to be a front for large-scale ad espionage abuse” rather than simply a legitimate ad company that was compromised or misused, is the detail that is likely to draw regulatory attention in Israel and in the jurisdictions where Discover-Tech’s ad inventory was served. TechCrunch’s reporting on the disclosure frames it as part of a broader pattern of governments using commercial surveillance vendors to extend their reach against journalists and civil society targets, a pattern Citizen Lab has documented repeatedly in prior reports involving different vendors and different delivery methods.
What Remains Unconfirmed
Several important details have not been established as of this report’s publication, and readers should treat claims on these points with caution until Citizen Lab or another credible investigation confirms them:
- Which government or governments commissioned the targeting of Al Jazeera-linked devices.
- The total number of devices worldwide that may have been exposed to AdFection-style delivery, beyond the 45 confirmed Al Jazeera cases.
- Any specific purchase price, licensing fee, or financial arrangement involving Discover-Tech, Controlium, Candiru, or Bindecy.
- Whether every advertisement served through Discover-Tech’s network was malicious, as opposed to the vast majority being ordinary commercial ads.
Regulatory and Legal Fallout to Watch
Mercenary spyware disclosures involving Israeli vendors have historically triggered export-control reviews, and Candiru itself has previously been named in sanctions actions by the U.S. Commerce Department tied to earlier surveillance scandals. A report naming Discover-Tech as an alleged front for spyware delivery, tied to a vendor with that kind of regulatory history, raises the prospect of similar scrutiny of Discover-Tech’s export licenses and its relationships with international ad exchanges. Advertising platforms that unknowingly carried Discover-Tech inventory may also face pressure from advertisers and publishers to document how their vendor-vetting process missed a company allegedly operating a spyware pipeline for months across 120,000-plus websites.
Press freedom organizations are likely to push this case further given the Al Jazeera connection specifically; targeting of journalists’ devices has been the trigger for past congressional hearings and export-control tightening in cases involving Pegasus. Whether this report produces comparable action depends heavily on whether the unconfirmed question of government attribution gets resolved.
Five Predictions for What Happens Next
- Expect at least one major ad exchange or demand-side platform to publicly confirm it removed Discover-Tech inventory from its network within days of the report, whether or not it was previously aware of the activity.
- Expect Citizen Lab or a partner research group to publish a technical follow-up detailing the specific targeting signals AdFection used to identify devices within the broader ad auction, since the October 15 report focuses on the discovery rather than a full technical breakdown.
- Expect renewed calls, particularly from press freedom groups, for mandatory security audits of ad-tech SDKs embedded in apps used by journalists and human rights workers.
- Expect Candiru’s name to resurface in future export-control or sanctions discussions given its prior regulatory history, even without new sanctions being confirmed immediately.
- Expect other security research groups to search their own telemetry for Discover-Tech or Controlium-linked ad activity, given how widely the inventory was distributed between March and June 2026.
What App Developers and Publishers Can Do Now
There is no consumer-facing patch for this kind of attack the way there is for a software vulnerability, because the exposure runs through an advertising relationship rather than a bug in an operating system. App developers and website operators who want to reduce their exposure to this category of risk can start by auditing which third-party ad SDKs and ad tags are embedded in their products, requesting disclosure from ad networks about vendor-vetting practices, and treating any ad network with opaque ownership or an unclear jurisdiction as a higher-risk dependency, the same way security teams already treat unvetted third-party code libraries. Organizations that have faced their own scrutiny over device-based tracking, including the backlash around always-on AI wearables and what they record, and the pushback some communities have raised over networked camera systems like the one at the center of a lawsuit over 126 Flock Safety cameras in Port St. Lucie, illustrate a broader pattern: consumer trust in any technology that touches personal data erodes quickly once a single documented abuse case becomes public, regardless of how many of its other deployments were entirely legitimate.
For enterprise security teams, the more immediate lesson may be procedural rather than technical: a vendor-risk review that only covers software suppliers and cloud providers, while treating advertising partnerships as a marketing decision rather than a security one, now has a documented gap. The same logic that pushed many organizations to formalize patching timelines after disclosures like the Ivanti zero-day chain earlier this year arguably needs to extend to the ad-tech vendors embedded in company-owned apps and websites.
Frequently Asked Questions
What is AdFection?
AdFection is the name Citizen Lab gave to a technique in which spyware is delivered to a target’s device through a targeted online advertisement, activating when the ad renders rather than when a user clicks a link or opens a file.
Who is Discover-Tech?
Discover-Tech is an Israeli company identified in Citizen Lab’s report as the operator of Controlium, the advertising platform Citizen Lab says was used to deliver spyware to targeted devices.
Which spyware was involved?
Citizen Lab’s report ties the campaign to spyware from Candiru and Bindecy, delivered onto devices associated with Al Jazeera through the Controlium advertising pipeline.
How many devices were affected?
Citizen Lab documented at least 45 devices associated with Al Jazeera that were targeted in 2024 and 2025. The total number of devices exposed worldwide has not been disclosed.
Do I need to click something to be infected?
No. Citizen Lab’s report describes the attack as zero-click, meaning the spyware could be delivered simply by an advertisement rendering on the device, without the user tapping a link or opening a file.
Were all Discover-Tech ads malicious?
No. Citizen Lab’s report does not claim that every ad served through Discover-Tech’s network was malicious. The documented spyware infections are tied to a specific set of targeted devices, not the entire ad inventory.
Which government was behind the targeting?
Citizen Lab has not named which government or governments commissioned the targeting. That detail remains unconfirmed.
Can regular ad blockers protect against this?
Citizen Lab’s report does not evaluate ad blockers as a mitigation, but security researchers covering the report, including coverage from PCMag, have noted that blocking third-party ad content generally reduces exposure to this category of attack, even though it is not a confirmed, tested defense against AdFection specifically.
