The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A phone can be compromised by an apparently ordinary advertisement without the owner tapping it. Citizen Lab’s Report 195, published October 15, 2026, documents a campaign it calls AdFection: Discover-Tech used real-time ad auctions to identify selected devices and return exploit code only to those devices. The investigation links the operation with high confidence to Candiru mercenary spyware, also called Integrity Labs.
What AdFection changed about malicious advertising
Traditional malvertising usually relies on a user clicking an ad, opening a landing page or installing something. AdFection moved the decisive step into the ad-delivery process itself. A bid request supplied advertising identifiers and IP information to Discover-Tech infrastructure. Its server assessed whether the device matched a target. If it did, the server returned malicious JavaScript that ran in the browser or an app and exploited the device without a click.
As an Amazon Associate I earn from qualifying purchases.
The advertisement shown to a recipient did not need to contain the exploit. Citizen Lab says that separation helped the campaign appear benign to platforms that delivered the ad: the visible creative could be ordinary while the hidden infrastructure selected victims and supplied the attack code later.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches“This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” Citizen Lab wrote in Report 195.
#1 Best Overall
Who was targeted and how much activity was found?
Al Jazeera devices
At least 45 devices inside the international news organization Al Jazeera were targeted during 2024 and 2025. Network logs showed a repeatable sequence from Discover-Tech advertising infrastructure to a Candiru validator and then to command-and-control servers. That temporal pattern, together with infrastructure fingerprints, is the basis for the high-confidence attribution described by Citizen Lab.
Ad-tech scale
Citizen Lab analyzed four billion Discover-Tech bidding records. The records showed ads appearing on almost 200,000 unique websites and Android and iOS apps in dozens of countries. Millions of devices were directed to profiling or infection servers, although the public evidence does not establish that every directed device was exploited.
| Measure | What the report establishes |
|---|---|
| Devices in the documented victim set | At least 45 Al Jazeera devices targeted in 2024–2025 |
| Bidding data examined | Four billion Discover-Tech records |
| Reach | Almost 200,000 websites and Android/iOS apps across dozens of countries |
| Devices sent to profiling or infection servers | Millions; the report does not say all were successfully infected |
How a zero-click infection unfolded
- An ad auction generated a bid request. Discover-Tech bought apparently normal inventory through the real-time-bidding ecosystem.
- Metadata identified the recipient. The request exposed advertising identifiers and IP information. Those details could be retained for profiling even when no exploit followed.
- A server-side eligibility check selected targets. Most recipients received no exploit code. A device that matched the operator’s criteria was sent to the next stage.
- JavaScript ran in the delivery context. The selected browser or app received malicious JavaScript from Discover-Tech infrastructure. No tap, click or download was required.
- A validator and command system completed the chain. Logs connected the ad infrastructure to a Candiru validator and then to command-and-control servers used by the spyware operation.
This design creates two different privacy and security outcomes. An unselected device may still have its advertising identifier and IP address collected, while a selected device can receive an exploit. Seeing no crash or unusual screen therefore does not prove that an ad request was harmless.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →AdFection compared with other delivery methods
| Characteristic | AdFection | Conventional malvertising | Earlier zero-click spyware delivery |
|---|---|---|---|
| User interaction | None required | Often a click, redirect or installation | None required |
| Delivery layer | Real-time ad auction and ad-serving infrastructure | Ad creative, landing page or redirect | Commonly a message, service or network-injection path |
| Targeting precision | Advertising IDs, IP data and device characteristics | Usually broad traffic or page-based targeting | Victim identifiers or network position |
| Exploit execution | Server-selected JavaScript returned after eligibility checking | Usually exposed after a user follows the ad path | Exploit delivered directly through the abused service or channel |
| Public evidence in this case | Network-log sequence and infrastructure fingerprints | Varies by campaign | Varies by campaign and forensic access |
| Intermediary accountability | Ad exchanges, vendors and consent systems are central to the chain | Ad networks and publishers are usually the main intermediaries | Messaging, telecom or service providers may be involved |
Which companies and systems appeared in the chain?
Discover-Tech operated the Controlium platform and used a NOAS/getAd server pattern. Citizen Lab linked that operation to Candiru/Integrity Labs and reported relationships or ad transactions involving Google, Yandex, Beeswax, Vungle/Liftoff, Eskimi, Sunteng and Xandr/Microsoft Advertising. The presence of a company or exchange in the transaction records does not by itself establish that it knew an exploit campaign was operating through its inventory; the report distinguishes infrastructure evidence from proof of customer intent.
Rank #3
The public report does not identify the government customer behind each attack. Citizen Lab also says a separate investigation, DARK CARTOGRAPHER, will be described later, so attribution beyond the operators and infrastructure identified in Report 195 remains incomplete.
What platforms did after the findings
| Organization or service | Reported action |
|---|---|
| Terminated Discover-Tech’s exchange access | |
| IAB Europe | Removed Discover-Tech from vendor registries |
| Beeswax | Removed Discover-Tech |
| Vungle/Liftoff | Paused access while reviewing the activity |
| Eskimi | Blocked associated accounts and domains |
These steps address the supply chain rather than asking individual users to recognize a suspicious banner. The case shows why vendor registries, exchange access, domain screening and audit logs need to work together: an ad that contains no visible exploit can still be the trigger for one.
What users and defenders should do now
- Install operating-system and browser updates promptly. Zero-click chains depend on exploitable software, so delaying security updates increases exposure.
- Treat spyware warnings as an incident. A platform alert, unusual security notification or credible warning should be preserved and escalated rather than dismissed because no link was clicked.
- Preserve evidence. Keep relevant device logs, mobile-device-management records, DNS and proxy data, and the timing of alerts. Do not factory-reset a potentially affected device before qualified responders decide what evidence is needed.
- Use expert incident response for high-risk targets. Journalists, activists, officials and organizations handling sensitive information should have specialists examine network and endpoint evidence.
- Demand ad-supply-chain controls. Exchanges and vendors should verify customers, monitor unusual redirect and script behavior, maintain auditable records and remove infrastructure quickly when abuse is reported.
The evidence in Report 195 supports platform-level screening, software patching and forensic response. It does not show that a generic antivirus product, ad blocker or consumer accessory stops this particular exploit chain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why AdFection matters beyond this campaign
Online advertising is designed to make rapid decisions about which device receives which content. AdFection abused that same decision layer as a covert targeting and exploit mechanism. The campaign therefore combines surveillance, ad-tech profiling and mercenary spyware in a single workflow. Citizen Lab says the incident illustrates structural weaknesses in an advertising system that failed to detect or prevent mass abuse, privacy invasion and facilitation of spyware attacks.
For ordinary users, the practical lesson is precise: an ad does not have to be clicked to be security-relevant. For platforms, the lesson is broader: reviewing only the visible creative is insufficient when server-side targeting can withhold the exploit until after an auction has identified a desirable device.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
