The short versionOn October 15, 2026, the University of Toronto's Citizen Lab published "Exposing AdFection," which it calls the first-ever technical demonstration of in-the-wild infection with zero-click mercenary spyware via targeted ads. It found with high confidence that devices at Al Jazeera were infected with Candiru spyware this way; TechCrunch reports at least 45 Windows computers in 2024 and 2025. The ad firm, Israel-based Discover-Tech, had appeared on "certified" and "approved" vendor lists kept by Google and IAB Europe. Both have removed it.
Most ad fraud costs money. This cost privacy. A new report shows spyware reaching devices through ordinary-looking targeted ads, with no click needed, bought through an ad firm that big industry lists had vetted.
What happened
On October 15, the University of Toronto's Citizen Lab published "Exposing AdFection," calling it "the first-ever technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements." It found with high confidence that devices at Al Jazeera were targeted and infected with Candiru's spyware this way. TechCrunch reports at least 45 Windows computers were hacked in 2024 and 2025.
The details
The ad firm. The ads came through Discover-Tech, an Israel-based company. Citizen Lab says its report "found no evidence that Discover-Tech was engaged in legitimate advertising activity." Yet Discover-Tech had "appeared on several lists of 'certified' and 'approved' advertising vendors maintained by Google and IAB Europe."
The reach. In the full report, Citizen Lab says ads with attacker script tags were shown to users of 75,373 Android and iOS apps and visitors of 120,768 websites. It stresses that an ad impression "does not in and of itself confirm targeting or infection with spyware."
The response. Google and IAB Europe have removed Discover-Tech from their vendor lists, and Google and Beeswax have cut off its access to their ad systems, according to Citizen Lab.
The warning. "If you might be targeted based on who you are or what you do, it's time to disable ad tracking on your devices or even block ads altogether," Citizen Lab senior researcher Bill Marczak told TechCrunch.
Why brands should care
Two reasons. First, "certified" vendor lists clearly don't guarantee who's buying in the ad auctions your brand runs in. Second, the same ad ID that powers targeting can be used to find a specific phone. If your team handles sensitive client, legal or financial info, their work phones are part of your security.
What to do
Our suggestions, based on Marczak's advice:
- iPhone: Settings > Privacy & Security > Tracking, and turn off Allow Apps to Request to Track.
- Android: Settings > Privacy > Ads, and delete your advertising ID. Menu names vary by phone.
- Consider an ad blocker on work devices for anyone whose job could make them a target.
Sources
- Citizen Lab: Exposing AdFection, executive summary (Oct 15, 2026)
- Citizen Lab: Exposing AdFection, full report (Oct 15, 2026)
- TechCrunch: Governments are hacking people with zero-click spyware by showing them online ads (Oct 15, 2026)
FAQ
What is AdFection?
Citizen Lab's name for a technique that uses targeted online ads to deliver zero-click mercenary spyware, meaning the victim doesn't have to click anything.
Who was affected by AdFection?
Citizen Lab found with high confidence that devices at Al Jazeera were infected with Candiru's spyware. TechCrunch reports at least 45 Windows computers were hacked in 2024 and 2025.
How can I reduce my risk?
Citizen Lab's Bill Marczak told TechCrunch that people who might be targeted should disable ad tracking or block ads. On iPhone, turn off Allow Apps to Request to Track; on Android, delete your advertising ID.
