What the Citizen Lab Report Found
On October 15, 2026, Citizen Lab published a report titled ‘AdFection’ that found the platform of Israeli advertising company Discover-Tech enabled mercenary spyware makers to target specific people and devices almost anywhere in the world. Malicious online ads install ‘zero-click’ spyware on devices — meaning the victim does not need to open a message or click a link. The report was covered by TechCrunch, and Ars Technica independently confirmed the research findings.
‘Zero-click’ means the device is infected without any action from the user: no message opened, no link clicked, no file downloaded. Such spyware products are sold to government clients; in this case at least two of them — Candiru and Bindecy — used the Discover-Tech platform to identify and select targets.
In practical terms, this means an attacker no longer needs to send the victim a phishing email or persuade them to click a malicious link. The ad network delivers the attack through its ordinary business — showing the right ad to the right person. When the target opens an ordinary web page or uses an app, the device is already infected via the ad displayed on screen.
Citizen Lab called this the first confirmed case of government-backed zero-click spyware being distributed through online ads. The researchers estimate that it puts a vast number of devices worldwide at risk. This is sharply different from classic ‘malvertising’ attacks: traditional malvertising is usually broad and indiscriminate, whereas here the ads are precisely targeted and the device that sees them is automatically compromised. Online ads have thus become not just a tool of deception, but an automated channel for targeted attacks.
How Al Jazeera’s Computers Were Compromised
According to the report, in 2024–2025 at least 45 Windows computers at the media organization Al Jazeera were compromised with Candiru spyware after being shown online ads laden with malicious code. The researchers established that the devices were infected specifically after the malicious ads were displayed. The report says ‘at least 45’ — the cases the researchers could prove; the fact that the attacks stretched over two years shows this was not a one-off operation but a long-term targeting campaign.
These were not randomly spread malicious ads, but targeted attacks on deliberately selected devices. The advertising ecosystem itself was used as the targeting mechanism: data about who sees an ad and on which device let the attackers find the right target and deliver malicious code to it.
Candiru and Bindecy — at least two zero-click spyware makers that used the Discover-Tech platform to select targets. Both companies sell their surveillance products to government clients. Citizen Lab found that their malware was delivered to specific people and devices through the Discover-Tech ad network.
Flaws in the Discover-Tech System
Citizen Lab researchers found serious security flaws in Discover-Tech’s Controlium control panel. The system’s login pages had their source code left open; researchers also downloaded user login records from an openly accessible section that required no password — including login credentials of at least two Candiru employees. These records show that Candiru employees used the Discover-Tech platform.
Additionally, billions of openly exposed ad auction (bidding) records on the Discover-Tech website showed that the company’s ads were displayed between March and June 2026 in tens of thousands of mobile apps and on websites — including on devices used by militaries, governments, critical infrastructure, and national cyber agencies. In other words, ads distributed through the platform reached not only journalists but also devices belonging to state institutions. The scale of the exposed records — billions — shows that the platform itself did not observe security hygiene: the researchers gathered all this data from open sources alone, with no unauthorized access.
What Experts Say
‘This report provides the first clear technical evidence that online ads can identify targets and automatically compromise them with ‘extremely high’ precision,’ Citizen Lab senior researcher Bill Marczak told TechCrunch.
Marczak advised people who might be targeted to disable ad tracking or block ads entirely. The report also highlighted the transparency problem in the ad-tech ecosystem: the exposed records, numbering in the billions, let the researchers map the platform’s reach.
Citizen Lab’s conclusion: the online advertising ecosystem has become not just a commercial tool, but also infrastructure for government-backed cyber operations. The significance of the ‘AdFection’ report is that it is the first to fully document the technical evidence of this process.
