Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Yes. A targeted online advertisement can infect a phone or computer without a click, download or link opening. Citizen Lab calls this attack pattern AdFection: an ad request profiles a device, and the ad server silently delivers exploit code and mercenary spyware only to selected targets.
Citizen Lab’s October 15, 2026 Report 195 links this infrastructure to at least 45 Al Jazeera devices targeted during 2024 and 2025. The findings represent the first public confirmation of zero-click mercenary spyware delivered through targeted advertising.
As an Amazon Associate I earn from qualifying purchases.
What “AdFection” means
AdFection is not a consumer spyware product. It is Citizen Lab’s name for using the real-time advertising supply chain as an infection channel. A winning advertisement is rendered in an ordinary website or mobile app, but the ad request also exposes identifiers and device characteristics that let an operator decide whether to send malicious JavaScript.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The victim does not have to tap the banner, open a landing page or install an application. If the device matches the operator’s criteria and the underlying software is vulnerable, simply rendering the targeted ad can begin the compromise.
How the zero-click attack works
- An ad is purchased. Discover-Tech’s advertisement wins a normal real-time bidding auction and is selected for display on a website or in an Android or iOS app.
- The ad request profiles the device. The creative calls a Discover-Tech NOAS/getAd server. That server receives advertising identifiers and other device data used for eligibility decisions.
- The server filters targets. Eligible devices receive JavaScript; other visitors receive no code or an ordinary ad response. This selective delivery makes the malicious traffic blend into routine ad operations.
- A validator checks the target. In the Al Jazeera cases, network logs showed traffic moving from Discover-Tech infrastructure to a Candiru validator.
- Spyware infrastructure takes over. The validator redirected qualifying devices toward Candiru command-and-control infrastructure, completing delivery without a user interaction.
Citizen Lab says this architecture means that “the simple display of a targeted ad is enough for infection” (Report 195, October 15, 2026).
#1 Best Overall
What happened to Al Jazeera devices
Citizen Lab found high-confidence evidence that at least 45 devices associated with Al Jazeera were targeted in 2024 and 2025. The laboratory attributed the infections to Candiru spyware delivered through Discover-Tech advertisements, based on the observed network sequence and matching infrastructure.
Candiru, also known as having rebranded as Integrity Labs, sells mercenary spyware rather than operating as a conventional advertising company. The case demonstrates how a commercial ad channel can conceal a highly selective intrusion aimed at journalists and media organizations.
Recommended Free Tools
“This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” Citizen Lab authors wrote in Report 195.
The campaign’s reach across the advertising ecosystem
Citizen Lab analyzed four billion bidding records from 2026 and found Discover-Tech ads appearing on almost 200,000 unique websites and Android or iOS apps in dozens of countries. The volume matters because a single malicious delivery system can reach many publishers while targeting only a very small group of people.
Media-network institutions with identified impressions included:
- Australia: 3 institutions
- Denmark: 3
- France: 1
- Mexico: 2
- Israel: 3
- Italy: 2
- Norway: 3
- Sweden: 3
These impressions do not mean every visitor was infected. They show how spyware operators could place targeted ads inside legitimate media environments at scale.
Who Discover-Tech and Controlium were in the chain
Discover-Tech functioned as a bridge between ordinary ad buying and mercenary spyware vendors. Its Controlium platform provided profiling, deanonymization, device fingerprinting and controlled targeting capabilities. Those functions let an operator narrow delivery to a person, organization or device type instead of exposing exploit code to every ad viewer.
The report identifies reported links involving Intelos, Bindecy and a threat actor called DARK CARTOGRAPHER. Those connections remain subjects of active investigation; they should not be treated as settled criminal findings. Likewise, a vendor’s presence in the advertising supply chain does not by itself prove that the vendor knew its infrastructure was being abused.
Rank #3
Why advertising-sector certification did not prevent it
Discover-Tech appeared on Google and IAB Europe certified or approved vendor lists from 2020 into 2026. Citizen Lab presents that history as evidence that vendor-list status and routine platform checks were not sufficient to detect or stop spyware misuse.
After disclosure, Google and IAB Europe removed Discover-Tech from their registries. Google and Beeswax terminated access, Vungle paused access for review, and Eskimi blocked related accounts and domains. Those actions reduced known access points, but they do not change the underlying risk: ad infrastructure can be repurposed faster than a publisher can inspect every creative and redirect.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCan a normal online ad infect your phone without a click?
Under the conditions documented by Citizen Lab, yes. The attack requires a targeted ad to be selected, device information to be available to the ad server, and a vulnerable execution path in the browser, operating system or embedded app component. A person can therefore be exposed while reading a page or using an app even when they never touch the advertisement.
This is different from ordinary malvertising that tries to trick a user into downloading a file. AdFection’s defining feature is the absence of a required tap or download; the ad-rendering process itself provides the delivery opportunity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Defenses that address the delivery path
Block targeted advertising at the network gateway
Citizen Lab judges gateway-level blocking to be the most feasible protection for defenders. A gateway can reject ad requests before they reach browsers and apps, covering managed devices on the organization’s network rather than relying on each endpoint to recognize a malicious creative.
Keep operating systems and browsers patched
Prompt updates reduce the number of exploitable components available to a zero-click chain. Patching does not identify a malicious ad, so it should be paired with traffic controls rather than treated as a complete defense.
Monitor ad and validator connections
Security teams should retain network telemetry and investigate unusual connections from ad-delivery infrastructure to validator or command-and-control domains. In the Al Jazeera investigation, that sequence was a key attribution signal.
Reduce unnecessary exposure
For sensitive users, limiting ad-heavy sites and apps reduces opportunities for a targeted creative to be rendered. This is a risk-reduction measure, not proof that an individual site is malicious.
Treat vendor badges as only one signal
Approval or certification in an advertising registry should not substitute for independent due diligence, abuse monitoring and rapid revocation procedures.
How defensive controls compare
| Control | Coverage and timing | Operational value |
|---|---|---|
| Gateway-level ad blocking | Gateway-wide; can block targeted ad requests before rendering | Citizen Lab’s recommended protection for sensitive organizations |
| Browser-only ad blocking | Limited to the supported browser; does not automatically cover every app | Reduces browser ad exposure but leaves other delivery surfaces |
| Network telemetry and alerting | Provides visibility into ad, validator and command-and-control connections | Supports detection and investigation after suspicious traffic appears |
| Operating-system and browser patching | Applies to managed software on each device | Removes known exploit paths but does not block ad requests |
What is established—and what is not
The Al Jazeera attribution to Candiru spyware delivered through Discover-Tech ads is high confidence in Citizen Lab’s assessment. The report does not establish that every advertising intermediary knew about the misuse, nor that every impression was an infection. Reported links to additional companies and DARK CARTOGRAPHER remain under investigation.
The practical lesson is narrower and more important than speculation about every participant: an ad can be both a commercial transaction and a precision delivery mechanism. Organizations protecting journalists, executives or other high-risk users should block targeted advertising at the gateway, maintain patches and inspect ad-related network telemetry instead of relying on vendor-list status alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
