Opening an app took no click. The spyware rode in on an ad.

On October 15, Citizen Lab published the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising[1]. They named the technique AdFection[1]. No suspicious link, no download, no click — simply opening a website or app is enough to trigger it[2].

(The name is a pun: ad plus infection.)

The chain of responsibility has four links, and none of them broke[1].

1. The operator. Discover-Tech, an Israeli adtech firm founded in 2020 that presents itself as a legitimate advertiser[1]. Inside its Controlium platform, Citizen Lab found an “OP Creative Upload” module that lets a client upload ad creative and attach a tag the client then pastes into its own campaign[1]. The same customer who buys banner space also buys the infection channel.

2. The institutional seal. Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020, apparently unaware of what it was doing with that access[2]. Six years of institutional endorsement — the detail that should worry any procurement reviewer most.

3. The scale. Citizen Lab analyzed nearly 4 billion bidding records and found Discover-Tech ads on almost 200,000 unique websites and Android/iOS apps across dozens of countries, over a four-month stretch between March and June 2026[1]. The Register breaks the same figure down as more than 70,000 apps and 120,000 websites[2]. Destinations included networks belonging to government agencies, defense organizations, and NATO — no evidence those were infected, but the ads could have been used to profile devices on them[2].

4. The payload. Candiru, the Israeli developer rebranded as Integrity Labs. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025, delivered through Discover-Tech’s ads[2]. In its analysis it identified a set of 305 validator server domains, several publicly attributed to Candiru by Sekoia and Recorded Future[1].

The part that matters most isn’t the payload. It’s that the ad infrastructure also covertly steered millions of devices into contacting Candiru-associated servers, most likely for large-scale tracking and reconnaissance[1]. Citizen Lab additionally links Discover-Tech to other mercenary surveillance actors — Intelos and Bindecy — and to an unnamed actor they call DARK CARTOGRAPHER, which exploits vulnerabilities across multiple mobile carriers to link advertising IDs to phone numbers[1].

The industry’s response came through the inventory channel. Google and IAB Europe revoked approved-vendor status[3]. Beeswax, Vungle, and Eskimi terminated their relationships; Eskimi’s last campaign stopped on 6 August 2026[1]. Citizen Lab sent comment requests to 13 companies and published their responses in full[1]. Its recommendation to the advertising industry is a default-deny policy for vendors operating in jurisdictions with weak accountability[1].

The three clauses

If your operation runs an analytics provider, an integrator, or any platform that routes data to third parties you never named, your RFP needs this in writing[1].

Clause 1 — Partner and platform inventory. The provider commits to delivering, on a quarterly cadence, the complete list of every partner, supply-side platform, exchange, and brand it routes data through, and to notify you within 24 hours of any approval revocation. Discover-Tech’s problem wasn’t technical. It was that nobody held a map of who else that provider was talking to[1].

Clause 2 — Extraction notification. Any data pulled during diagnostics or troubleshooting gets reported to the customer within 24 hours, with a named recipient and a timestamp. It’s the same lesson as the Alfozan case, published earlier today: material extracted “for support” is material that left your perimeter.

Clause 3 — Traceable revocation. When a provider loses an approval, certification, or compliance status at any link in its chain, you get that event in 24 hours with evidence, not a press release[3]. Five companies lost theirs — Google, IAB Europe, Beeswax, Vungle, Eskimi — and not one notification reached the end customer. That gap is exactly what this clause closes.

P.D. Does your analytics or video-integration RFP today have a clause forcing you to know who else your provider talks to? If the answer is “no, just the provider,” you’re running the same incomplete map the ad market ran on for six years[2].

📰 Sources: [1] Citizen Lab, “Exposing AdFection”, 15 Oct 2026 · [2] The Register (Carly Page), 15 Oct 2026 · [3] State of Surveillance, 18 Oct 2026.

Sources

  1. Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
  2. The Register — Carly Page, Spyware vendors found a way to make targeted ads even worse — https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334
  3. State of Surveillance — Daily Surveillance Briefing, October 18, 2026 — https://stateofsurveillance.org/news/daily-surveillance-briefing-october-18-2026/

Sources: [1] https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware — Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Oct 15 2026) [2] https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334 — The Register — Carly Page, Spyware vendors found a way to make targeted ads even worse (Oct 15 2026) [3] https://stateofsurveillance.org/news/daily-surveillance-briefing-october-18-2026/ — State of Surveillance — Daily Surveillance Briefing Oct 18 2026