The modern advertising industry has found a way to exceed even its own standards for intimacy. According to an investigation published October 15 by the University of Toronto’s Citizen Lab, targeted online ads were used to deliver zero-click mercenary spyware to devices at Al Jazeera. You did not need to tap a suspicious link. In the researchers’ documented cases, displaying the ad was enough. The customer journey has officially escaped its containment plan.

🤚 The Open-Palm Impression

Citizen Lab calls the technique AdFection and describes its findings as the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. Its report links the attacks to Candiru, which it says has rebranded as Integrity Labs, and to ads purchased by an Israeli company called Discover-Tech. These are the researchers’ findings, not a claim that every ad on the internet is malware.

The documented infections occurred at Al Jazeera; The Register reports that researchers traced attacks against at least 45 of its devices in 2024 and 2025. Citizen Lab says Discover-Tech’s Controlium platform enabled spyware partners to identify targets and serve controlled ads designed to deliver code when rendered.

The essential mechanism begins in the ordinary real-time auction for an ad slot. A bid request can reveal device and location information to potential buyers. A selected ad may then execute code or load other code inside the app or browser displaying it. Citizen Lab found that Discover-Tech used this architecture to route ad impressions back through its own infrastructure and, for selected targets, toward spyware delivery. What is usually sold as relevant engagement appears, in these cases, to have become an exceptionally well-dressed infection vector.

👐 The Two-Handed Auction

The scale of the surrounding ad activity should not be confused with the number of confirmed infections. Citizen Lab analyzed roughly four billion bidding records and says Discover-Tech ads appeared across almost 200,000 websites and mobile apps over a four-month period. The researchers also observed millions of devices directed toward infrastructure associated with Candiru, but explicitly caution that those connections do not prove millions of spyware infections. Reach, tracking and compromise are different things, regardless of how enthusiastically a dashboard groups them.

There is another, more structural problem: the gatekeepers apparently treated the alleged facilitator as an approved guest. Citizen Lab says Discover-Tech appeared on approved-vendor lists maintained by Google and IAB Europe, and that its ads were served through major networks. Following disclosure, Google removed the company from its approved lists and terminated access to its ad exchanges; IAB Europe and several other ad vendors also took action. A vendor badge, it turns out, is not a substitute for asking what the vendor actually does.

Citizen Lab also identifies a separate actor it calls DARK CARTOGRAPHER using related infrastructure to link advertising identifiers with phone numbers through mobile-carrier vulnerabilities. That is a distinct finding about deanonymization, not evidence that every person whose identifier appeared in a bid request was infected. These distinctions are important precisely because the underlying system is sprawling enough to make frightening numbers seem interchangeable.

🌿 The Gentle Awakening

Imagine a journalist opening a routine news app while preparing an interview. An advertising exchange sells the opportunity to show an ad, and the bidder learns enough about the device to decide it is a desirable target. If the malicious impression is served, the attack need not wait for the journalist to click. That scenario explains why ordinary advice such as “don’t open suspicious attachments” does not cover this particular route. It does not mean that any specific reader has been compromised.

For organizations protecting high-risk staff, the relevant lesson is to treat ad delivery and third-party code as part of the attack surface, keep devices and apps updated, and use available high-risk protections where appropriate. For exchanges and regulators, the harder question is whether a marketplace designed to broadcast granular information and execute third-party code can be adequately policed by vendor registration alone. Citizen Lab is calling for investigations and changes across the advertising ecosystem, not merely a revised privacy-policy font.

👑 The Gold-Leaf Reckoning

This case is notable because the researchers present technical evidence of infection via ads, not just evidence that ad targeting could be abused. The documented victims are specific; the surrounding ad footprint is much larger; the two should not be conflated. The industry’s response to Discover-Tech shows that access can be revoked. It does not yet show that the business model which made such access valuable has been repaired.

The internet’s smallest luxury is apparently the right to read a page without the ad auction deciding you are worth invading. For a sector built on knowing its audience, that would be a remarkably ambitious product improvement.

“We have upgraded your personalized advertising experience to include an unsolicited security incident.” — The Slap of Wisdom Department of Bespoke Surveillance, declining the complimentary cookie