How AdFection Turned Real-Time Bidding Into a Spyware Pipeline
Citizen Lab at the University of Toronto published research on Thursday documenting AdFection, which the researchers describe as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted advertising. The malware is attributed to Candiru, and the delivery infrastructure to Discover-Tech, an Israeli advertising firm. At least 45 devices at Al Jazeera were infected during 2024 and 2025, according to the reporting.
The delivery mechanism ran through Controlium, a malicious ad targeting platform that Citizen Lab says exploited real-time bidding infrastructure to identify and reach specific individuals. Infection required no interaction: loading a website or opening an installed app was sufficient. The exploits worked on both iOS and Android, which means the pipeline did not depend on a single operating system's weaknesses. The target's only action was ordinary device use.
Real-time bidding was built to price anonymous audience segments in milliseconds, not to select named people. Controlium repurposed that plumbing as a targeting system, and Citizen Lab's report documents the platform operating at billion-bid scale. That suggests the infrastructure was a standing capability with industrial throughput rather than an improvised hack. The open question is how long such a pipeline can operate inside a vetted ad ecosystem before anyone audits it.
What Citizen Lab Found on Al Jazeera's Devices
The attacks are pernicious on forensic grounds. Because infection required no click and left no visible trace, targets had no way to know their devices were compromised unless they ran specialized forensic hardware or software. Reporting at arstechnica.com notes that this invisibility is what distinguishes zero-click delivery from phishing-based campaigns, where a suspicious message at least gives defenders an artifact to examine after the fact.
The campaign's footprint extended well past the newsroom. Researchers found Discover-Tech ads on more than 70,000 apps and 120,000 websites, and reporting at hackread.com adds that the same ad system reached government networks. Citizen Lab's report also documents Discover-Tech's links with mercenary spyware, ADINT, and mass surveillance vendors, placing the ad operation inside a wider surveillance marketplace rather than treating it as an isolated advertising abuse case.
The 45-device figure is a floor, not a census, because zero-click infections are only discoverable through forensic examination of seized or volunteered hardware. The record is silent on how many other Al Jazeera employees, or targets at other organizations, were exposed to the same ads. What the documented reach across 70,000 apps shows is that the delivery surface spanned a substantial portion of the app and web advertising ecosystem.
Google and IAB Europe Cut Discover-Tech Loose
The industry response came after publication, not before. Discover-Tech had been listed as an approved vendor by Google and IAB Europe since 2020. Following the investigation, Google terminated the firm's access to its advertising platforms, and IAB Europe suspended Discover-Tech from its Global Vendor List. Both actions were reported at biggo.com; the record contains no independent public statement from either body on how the approval survived five years.
Approval since 2020 means the vetting systems of Google and IAB Europe certified the same firm that Citizen Lab now describes as running a malicious ad targeting platform. The suspension mechanism worked, but only after external researchers published forensic findings. That suggests the industry's controls are reactive: they detect abuse that produces evidence, and zero-click spyware produces almost none until someone goes looking for it.
Two signals matter now. The first is whether Google and IAB Europe publish the audit criteria that admitted Discover-Tech in 2020, which would show the approval process can be examined rather than merely revoked. The second is whether real-time bidding operators adopt continuous behavioral screening of bidders, because a one-time vendor list cannot catch a platform whose malicious behavior only appears at bid time, when a specific person is selected.
Sources
- arstechnica.com — Targeted Ads Delivered 0-Click Mercenary Spyware to Al Jazeera's Devices
- hackread.com — Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware (2026-10-15)
- citizenlab.ca — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click… (2026-10-15)
- biggo.com — Zero-Click Spyware Delivered Through Online Ads Infected Al Jazeera Devices, Researchers… (2026-10-15)
- New Horizon daily digest, 2026-10-16 (topic provenance)