Opening a news app or checking a sports score can now carry a documented security risk for targeted individuals, one that requires no click, no tap, and no link. On October 15, 2026, Citizen Lab published findings describing what researchers call the first confirmed case of mercenary surveillance app spyware delivered through the targeted online advertising system, a technique they named AdFection.
How the Attack Works
The alleged attack weaponized the automated ad-auction infrastructure that delivers many digital advertisements to phones and browsers.
Many digital ads are delivered through real-time bidding, an automated auction that sends data about a device, location, and browsing context to participating advertising companies. Citizen Lab alleges that Discover-Tech’s Controlium platform exploited that data flow to identify specific devices, then deliver attacker-controlled scripts the moment an advertisement rendered on screen.
Those scripts reportedly connected targeted devices to infrastructure associated with Candiru, an Israeli commercial spyware developer. Citizen Lab researcher Bill Marczak told Wired that operators could “automatically hack specific individuals” while those individuals browsed the internet or used an app, potentially without interacting with the ad at all.
Who Was Targeted and How Far the Infrastructure Reached
Citizen Lab tied 45 Al Jazeera devices to confirmed attacks, while separately documenting a far broader advertising footprint across apps and websites.
Citizen Lab linked 45 Al Jazeera devices to zero-click attacks carried out during 2024 and 2025. Researchers also reported that Discover-Tech advertising records appeared across more than 70,000 mobile apps and 120,000 websites between March and June 2026.
The networks reportedly exposed to this advertising infrastructure include government agencies, NATO, the United Nations, and European lawmakers. Australian critical infrastructure and military or government bodies in Norway and Sweden also appeared in the reported exposure.
One critical caveat applies. The presence of a Discover-Tech ad on a platform does not establish that every impression was configured to deliver spyware. The strongest technical evidence concerns specifically targeted devices, not routine ad viewing by ordinary users.
Platform and Industry Response
Google, IAB Europe, and Beeswax all took action against Discover-Tech after the findings emerged, according to Wired’s reporting.
Google told Wired it blocked Discover-Tech from its advertising platforms after a joint investigation with Citizen Lab and the ad-security firm Confiant, citing systematic policy violations, and created Safe Browsing warnings for linked websites. IAB Europe suspended Discover-Tech from its Global Vendor List following an audit, adding that confirmed spyware findings could support permanent expulsion. Beeswax said it removed Discover-Tech from its platform after validating the reported activity.
Discover-Tech and its chief executive did not respond to Wired’s requests for comment before publication. Integrity Partners, which reportedly controls Candiru’s assets following US sanctions, also did not respond
What Ordinary Users Can and Cannot Do
Citizen Lab says reliable defenses against sophisticated zero-click ad attacks are limited, and none can guarantee protection for a specific target.
Citizen Lab researchers said the options available to most people are limited and imperfect. Blocking ads as thoroughly as possible across websites and apps is the measure researchers pointed to most directly, though they acknowledged that applying it consistently across every surface where ads appear is difficult. A related concern affecting mobile privacy involves apps secretly tracking users through other means, underscoring how layered these risks have become.
Keeping operating systems, browsers, and apps current remains a baseline step to stay safe. Updated software, however, does not guarantee protection against unknown vulnerabilities exploited by commercial spyware operators. The evidence in this investigation concerns targeted individuals, not a finding that routine ad exposure has broadly compromised consumer devices.
A Structural Shift in the Attack Surface
AdFection moves the zero-click threat from messaging apps to the advertising layer present in a large share of the apps and websites people use every day.
Zero-click spyware has historically been associated with vulnerabilities in messaging platforms and communication software. AdFection shifts that concern to the advertising layer present across tens of thousands of apps and websites. Scrutiny of real-time bidding data exposure, advertiser identity verification, and the audit standards that ad exchanges apply to their vendor lists is likely to follow, though those outcomes remain analysis rather than established fact.
