For years, security people have told everyone the same thing: don’t click strange links, don’t open odd attachments, and you will dodge most attacks. A report published this week by Citizen Lab, the digital rights research group at the University of Toronto, shows how little that advice helps against the most expensive spyware on the market. According to the researchers, an Israeli advertising company built a pipeline that let spyware operators pick a target, win an ordinary online ad auction for that person’s screen, and start an infection the moment the ad loaded.
Nobody had to tap anything. The ad just had to appear.
Citizen Lab calls the operation “AdFection,” and its researchers describe it as the first publicly documented case of mercenary spyware being delivered in the wild through targeted digital advertising. WIRED summed it up with a phrase from one of the researchers: a “nightmare scenario.”
The short version
- Citizen Lab says Israel based Discover-Tech bought ad space through major ad exchanges and used it to steer selected people to servers linked to the spyware vendor Candiru.
- At least 45 devices belonging to Al Jazeera staff were targeted, and Citizen Lab links the activity to Candiru “with high confidence.”
- Discover-Tech ads reached about 120,768 websites and 75,373 apps, roughly 196,000 in total.
- Google has cut Discover-Tech off from its ad exchange. IAB Europe, Comcast’s Beeswax, Liftoff and Eskimi have also suspended or blocked it.
- The most direct defense the researchers point to is blocking ads and limiting ad tracking identifiers.
How an ad becomes an infection
To understand the attack, you need to know what happens in the fraction of a second before an ad shows up on a web page or inside an app. Most online ads are sold through real-time bidding. When you open a page, the site sends out a “bid request” describing the available slot, and that request usually includes details about you: your IP address, your rough location, the app or site you are using and, on phones, your mobile advertising ID. Ad buyers’ software scans those details and bids. The winner’s ad is served to your screen, all in well under a second.
That system was built to show you shoes you looked at yesterday. Citizen Lab says Discover-Tech used it to find one specific person.
Here is the chain as the researchers describe it. Discover-Tech operated its own demand side platform, the kind of software advertisers use to buy ad slots, and plugged it into exchanges run by Google, Yandex, Liftoff’s Vungle, Eskimi and Comcast’s Beeswax, among others. Operators could feed it identifiers for a person they wanted, such as an IP address or a phone’s advertising ID. When a matching bid request came through, the platform bid to win that slot.
The ads themselves carried a small script. For practically every viewer, the server behind that script returned nothing at all, which kept the campaign quiet. For a selected target, it returned JavaScript that sent the device to a Candiru validation server and then to a command server, which could attempt to load an exploit. “The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario,” Wolfie Christl, one of the report’s authors, told WIRED. His colleague Bill Marczak said the setup let operators “automatically hack specific individuals” while they browsed or used apps.
Who was hit
The clearest victims were journalists. Citizen Lab says at least 45 devices belonging to Al Jazeera staff were targeted through Discover-Tech ads and links the activity to Candiru with high confidence. Al Jazeera’s own security team isolated a Windows DLL from one machine that contained two command server addresses matching the campaign’s infrastructure. The network condemned the operation as an “assault on press freedom.”
One detail is worth being precise about. Headlines, including WIRED’s, talk about phones, and the ad network certainly reached phones: more than 75,000 apps on Android and iOS served Discover-Tech ads. But the compromises investigators have confirmed so far were reportedly on Windows computers. The first stage exploit was never recovered, so it is not public which browser or app flaw was used, and no CVE or vendor patch has been tied to AdFection yet.
Citizen Lab did not say which government or client ordered the attacks.
The ads also showed up inside governments
The researchers found the data that made this report possible in an unusual place: two world readable databases on a Discover-Tech domain, holding about 4 billion bid records. Those records show where the company’s ads were displayed. The list includes networks belonging to defense ministries, armed forces, cyber agencies, NATO, the United Nations, the European Parliament, the European Commission and critical infrastructure operators. Those were ad impressions, not confirmed infections, but they show how far a single ad buyer can reach.
The business side looks odd for a real ad company. According to the report, Discover-Tech’s buying platform had three advertisers, nearly all tied to Discover-Tech itself, recorded zero conversions and spent about $109,000 over four months. Ad security firm Confiant, which published a companion analysis, estimated the operation pushed at least 10 million ads a day.
Citizen Lab director Ron Deibert told CBC that the case is “a recipe for disaster,” because it joins two poorly regulated industries that are both heavily abused: targeted advertising and mercenary spyware.
Who responded, and how
| Company or group | Role | Response so far |
|---|---|---|
| Ad exchange operator | Removed Discover-Tech for “systematically violating” its policies, cut exchange access and added Safe Browsing protections for the operation’s domains. | |
| IAB Europe | Runs the industry’s vendor list | Suspended Discover-Tech from its Global Vendor List and said confirmation could justify permanent expulsion. |
| Beeswax (Comcast) | Ad buying platform | Removed the company. |
| Liftoff / Vungle | Mobile app ad exchange | Paused access pending review. |
| Eskimi | Ad platform | Blocked accounts and domains. |
| Discover-Tech | Accused ad intermediary | Did not respond to requests for comment. |
| Candiru / Integrity Labs | Spyware vendor | Did not respond. |
Before this month, Discover-Tech had been listed as an approved vendor by Google and IAB Europe since 2020, according to the reporting. It was removed in early October, shortly before the report went public.
Candiru is not a new name
The spyware vendor at the end of the chain has a long record. Ad based infection is also not a new idea; what is new is public technical proof that it happened in the real world.
| When | What happened |
|---|---|
| 2020 | Citizen Lab finds 36 phones of Al Jazeera staff hacked with NSO Group’s Pegasus through a zero-click iMessage exploit called KISMET. |
| July 2021 | Citizen Lab and Microsoft expose Candiru, finding at least 100 victims and Windows zero-days that Microsoft patched. |
| Nov 2021 | The US Commerce Department puts Candiru and NSO Group on its Entity List. |
| July 2022 | Avast ties a Chrome zero-day, CVE-2022-2294, to Candiru attacks on journalists. |
| Sept 2023 | Haaretz reports on Insanet’s “Sherlock,” a system marketed to infect devices through ads. |
| Dec 2025 | Leaked documents describe “Aladdin,” an ad based infection vector for Intellexa’s Predator spyware. |
| Oct 2026 | Citizen Lab publishes AdFection, documenting ad delivered spyware in the wild for the first time. |
What actually protects you
The honest first point: most people are not the target of spyware that costs governments millions of dollars per infection. AdFection was aimed at journalists and, very likely, at people of interest to intelligence services. Still, the report changes what “good hygiene” means, and some of its lessons apply to everyone.
- Use a real ad blocker. On desktop, that matters more since Chrome dropped the most capable extensions. We covered why Firefox and Brave became the main options for strong ad blocking after Google’s Manifest V2 shutdown.
- Kill your advertising ID. Targeting in this campaign relied on identifiers like the mobile ad ID. On iPhone, keep “Allow Apps to Request to Track” switched off under Settings, Privacy and Security, Tracking. On Android, open Settings, Privacy (or Google), Ads, and delete your advertising ID.
- Turn off personalized ads in your Google and Apple accounts. It shrinks the data in each bid request.
- Keep everything updated. No AdFection specific patch exists, but the exploit still needs a browser or app bug to work, and updates close those.
- If you are high risk, go further. Apple’s Lockdown Mode and Android’s Advanced Protection are not named in this report, but both are designed to shrink the attack surface that mercenary spyware relies on. Apple also now shows threat notifications right on the iPhone lock screen when it believes you were targeted.
The bigger issue is not something you can fix with a settings menu. The ad industry spent two decades building a system that broadcasts detailed information about billions of people to anyone willing to bid. AdFection is what happens when the wrong bidder joins the auction. Citizen Lab is now asking regulators to look at how companies like Discover-Tech got approved in the first place, and that question may end up mattering more than any single ad block list.
Sources and further reading
- UNILAD Tech: ‘Nightmare scenario’ as zero-click software can now infect smartphones
- Citizen Lab: Exposing AdFection (executive summary)
- TechCrunch: Citizen Lab says online ads are being abused to deliver zero-click spyware
- CyberScoop: AdFection and Discover-Tech
- CBC: Israeli firm used ads to enable espionage, researchers say
- CPJ: Ad tech firm enabled spyware targeting of at least 45 Al Jazeera devices
- Citizen Lab: The Great iPwn (2020)
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
