Researchers at the University of Toronto's Citizen Lab say a company that presented itself as an advertising firm used the ordinary online ad market to deliver mercenary spyware to journalists' devices. The targets did not need to click anything. Citizen Lab published the findings on October 15, 2026, as Report 195, titled "Exposing AdFection." It calls the case the "first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising."
The company is Discover-Tech. According to the report, it ran a platform called "Controlium" and its own demand-side platform, MyDSP, which connected to ad exchanges including Google, Yandex, Vungle (Liftoff) and Sunteng. Citizen Lab says Discover-Tech used these ad purchases as the first stage of an infection chain that ended at servers belonging to Candiru, the mercenary spyware vendor. Citizen Lab says Candiru has rebranded as "Integrity Labs." The confirmed targets were at Al Jazeera, where at least 45 devices were targeted in 2024 and 2025.
The report's authors are Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. BleepingComputer reported on the findings on October 16. Neither source identifies a CVE specific to this campaign. Citizen Lab's report refers only to CVEs from earlier, separate Candiru investigations.
How the attack worked
The method relied on the infrastructure that runs everyday online advertising. A demand-side platform bids in real-time auctions for the chance to show an ad to a particular device. When the bid wins, the ad's markup, which can include scripts, loads in the user's browser or app.
Citizen Lab and BleepingComputer report that Discover-Tech's ads carried JavaScript that contacted a Discover-Tech server the researchers call the NOAS server, also referred to as the "getAd server." BleepingComputer, citing the report, says the server used "multiple parameters (e.g., IP address, ad identifiers)" to decide whether a device was eligible to receive code. Eligible targets received JavaScript. All other devices got an empty, zero-byte response. As a result, the ads delivered nothing further to the vast majority of devices that loaded them.
For a selected target, network logs reviewed by Citizen Lab showed a sequence: traffic went from Discover-Tech infrastructure to a Candiru "validator" server, and then to Candiru command-and-control infrastructure. BleepingComputer reports that rendering the malicious ad on the victim's device was enough to start this sequence, which is why the attack counts as zero-click.
Citizen Lab says Al Jazeera isolated a Windows DLL from one of the compromised devices. The researchers conclude "with high confidence" that the sample is a newer version of the Candiru attack chain they documented in 2021. BleepingComputer notes that Candiru sells its surveillance tools "officially only to governments" and developed the Windows malware known as DevilsTongue. It also says Candiru's tools have previously been deployed through Windows and Chrome zero-day exploits against journalists, activists and politicians. Citizen Lab says it is not known exactly which governments are using these capabilities, and this article does not identify the operator behind the Al Jazeera targeting.
Citizen Lab says Discover-Tech "serves as a bridge between ad vendors and the mercenary spyware ecosystem." The report also describes connections to two other firms. One is Intelos: a shareholder and director of Intelos was a director of Discover-Tech from 2020 to 2025, and the two companies' websites shared a single web-hosting account. The other is Bindecy, which the report calls another mercenary hacking company. Users associated with Bindecy were logging into Controlium. The report does not establish a formal corporate relationship with Bindecy.
The numbers, and what they do and do not measure
Citizen Lab analyzed exposed MyDSP bidding records covering March through June 2026. Over that period, according to the report:
- MyDSP bid on about 3.77 billion ad impressions and won about 442 million, a win rate of about 11.7 percent.
- About 719 million of those bids, roughly 19 percent, were for ads containing the NOAS script tags.
- The ads appeared on about 75,373 apps and 120,768 websites.
- Separately, between January and June 2026, an unauthenticated endpoint recorded about 3.64 million "eligible users" directed to a Discover-Tech tracking domain. The report notes that other Discover-Tech customers may also have used this feature.
- Researchers found 305 domain names on 319 IP addresses that matched their fingerprint for Candiru validator infrastructure, with hosts observed from August 2022 through July 2026.
- Impressions reached government-operated networks in 24 countries, as well as NATO, United Nations and EU institution networks. The researchers say the investigation is ongoing.
These figures measure exposure, not infection. A device that showed a Discover-Tech ad was not necessarily compromised. Because the server returned nothing to non-targets, most of those devices were only screened. The confirmed targeting in the report is the Al Jazeera group of at least 45 devices. The exposure figures still matter because they show how many devices were screened, and on which networks, including government and intergovernmental ones.
The ad industry's response
Discover-Tech was not operating on the fringes of the market. According to Citizen Lab, from 2020 until early October 2026 Google listed the company as an "Ad Manager Certified External Vendor," an "Ad Technology Partner" and an "Ads Personalization Provider." IAB Europe had carried Discover-Tech on its Transparency and Consent Framework Global Vendor List since July 2, 2020. The report describes that registration as a de facto requirement for taking part in European digital advertising. Google removed Discover-Tech from its vendor registry and terminated its access to Google's ad exchanges in early October 2026. IAB Europe removed the company from its list on October 8, 2026.
Other platforms also acted. Beeswax removed the company, Vungle (part of Liftoff) paused its access pending review, and Eskimi blocked its accounts and domains. Citizen Lab says Bindecy, Intelos and Xandr, Microsoft's ad platform, did not respond within its timeline.
Citizen Lab's findings are not the first report of ad-based spyware delivery. BleepingComputer notes that in late 2025, Amnesty International documented a similar ad-based delivery method called "Aladdin," which was used to deliver Intellexa's Predator spyware. Citizen Lab's distinction is that it calls its finding the first public technical confirmation of a zero-click attack delivered this way, backed by network logs and a recovered sample.
Why this is harder to see
Most spyware delivery that defenders train for leaves something to inspect: a phishing link, a malicious attachment, or an exploit sent through a messaging app. In this case the first stage came through paid ad placements bought on mainstream exchanges and shown in ordinary apps and websites. The targeting decision was made on Discover-Tech's server, so a device that was not selected received nothing to examine. The data that made the targeting precise, including IP addresses and device advertising identifiers, is the same data the ad industry already collects and trades for ordinary advertising.
The vendor certification problem is also significant. Platform and industry vendor lists are meant to give publishers and buyers some assurance about who is in an auction. In this case, a company Citizen Lab links to a spyware delivery chain held those listings until early October 2026.
What It Means for Defenders
No CVE, patch or vendor advisory is associated with this campaign, so there is no version to update to and no KEV deadline. The defensive work here is about controlling exposure.
- Treat ad delivery as an attack surface for high-risk users. Citizen Lab recommends blocking ads and tracking both on devices and at the network gateway, and moving toward browsers with built-in anti-tracking and ad-blocking features. For journalists, executives, government staff, diplomats and others plausibly targeted by mercenary spyware, enforce this on managed endpoints through browser policy, managed content-blocking extensions or DNS-level filtering.
- Reduce identifiers that make targeting possible. On managed mobile devices, limit or reset the device advertising identifier where the platform allows it, and restrict ad tracking through mobile device management (MDM) policy. The reporting says the NOAS server used IP addresses and ad identifiers to decide which devices received code.
- Review the apps on high-risk devices. The ads appeared in about 75,373 apps. Ad-supported apps on sensitive devices create exposure. Where possible, use paid or ad-free versions, or remove apps that have no business need.
- Use the report's indicators. Citizen Lab's report includes a DLL hash, command-and-control domains, and the Controlium, NOAS and tracking domains. Eskimi's published response names the getAd loader domain and several mtrtb.com subdomains. Check DNS, proxy and firewall logs for contact with this infrastructure. Network logs were how the researchers reconstructed the chain from ad impression to Candiru validator to command-and-control.
- Government and intergovernmental networks should check ad traffic. Citizen Lab says impressions reached government-operated networks in 24 countries, plus NATO, UN and EU institution networks. Security teams on those networks should review historical egress logs for the infrastructure named in the report and monitor traffic linked to ad impressions.
- Ad-tech buyers and publishers: audit your supply chain. Check whether Discover-Tech, MyDSP or related entities appear in your demand partners, ad-quality logs or vendor lists, and confirm they have been removed. Industry vendor listings did not keep this company out.
- Get help if you suspect targeting. Organizations that think staff may have been targeted should preserve device and network logs and contact a specialized response group, such as the researchers who published this work, before wiping devices.
