Summary
A Citizen Lab report links targeted ads purchased by Discover-Tech to Candiru spyware attacks against devices at Al Jazeera. Its analysis also found ads containing attacker scripts displayed across tens of thousands of apps and websites.
A Citizen Lab report published on October 15, 2026, links targeted online advertisements bought by Israeli company Discover-Tech to zero-click attacks using Candiru spyware against devices at international news network Al Jazeera. The researchers call the method “AdFection”: an ad can trigger the attack when it is displayed, without the user clicking it.
The report presents what Citizen Lab describes as the first public technical confirmation of mercenary spyware delivered through targeted advertising. Its findings also show how ad systems designed to select audiences and deliver code can be repurposed for surveillance and device hacking.
How an advertisement can deliver spyware
Many online ads are served through real-time bidding. When a website or app requests an ad, information about the user and device can be shared with advertising companies as they compete to place one. Ads may also contain code that runs in the app or browser, not just an image or video.
Citizen Lab says Discover-Tech used this system to put advertisements in front of selected users. A script in the ad contacted a Discover-Tech server, which could receive identifiers such as a mobile advertising ID or browser cookie, along with other information. The server could then return JavaScript for a targeted device; for other ad impressions, it returned no code. That JavaScript could load further code, including a browser exploit capable of installing spyware.
The report identifies Discover-Tech’s Controlium platform as a system for selecting targets using mobile advertising IDs, browser identifiers or IP addresses, and for managing “controlled ads.” The researchers also describe a server, referred to as a NOAS or “getAd” server, that could decide whether a device should receive code. This separation meant the malicious code could be delivered through the ad without being directly supplied to the companies displaying it.
Evidence from attacks at Al Jazeera
Network logs provided to Citizen Lab by Al Jazeera show a sequence of connections during attacks in 2024 and 2025. Targeted devices first contacted Discover-Tech infrastructure, then a Candiru validator server, and later a Candiru command-and-control server. At least 45 devices within Al Jazeera were targeted.
The researchers also examined a Windows spyware sample recovered from a compromised device. Its command-and-control domains matched the infrastructure they had identified, and aspects of its code resembled a Candiru attack chain documented in earlier research. Citizen Lab says the combined evidence links the attacks to Candiru with high confidence. The report does not give a count of how many of the targeted devices were successfully infected.
The reach of the advertising activity
To assess the scale of Discover-Tech’s ad operations, Citizen Lab examined nearly four billion bidding records for March through June 2026. In that period, Discover-Tech’s MyDSP platform bid on 3,770,286,576 ad impressions and appears to have won 441,954,291, or 11.7%.
The researchers identified 718,748,885 bids—about 19% of the total—for ads that appeared to contain a script tag pointing to a NOAS server. Ads with attacker scripts were displayed in 75,373 Android and iOS apps and on 120,768 websites. These figures describe where such ads appeared; they do not mean every device that received one was targeted or infected. Citizen Lab says most ad impressions did not result in JavaScript being returned, although the ads could still collect some information, including cookies or a device’s public IP address.
The report says Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026. Google terminated the company’s access to its ad exchange platforms; Beeswax removed it from its buying platform; Vungle paused access while reviewing the matter; and Eskimi blocked its accounts and domains. The findings underline a security risk in an ecosystem where ad targeting data and code running inside apps and websites can provide both a route to reach particular users and a way to deliver harmful content.