On 15 October 2026, Citizen Lab at the University of Toronto published a report it calls AdFection. It is the first public technical confirmation that mercenary spyware has been delivered through ordinary targeted online advertising, with no click required.
What happened. At least 45 devices at Al Jazeera were targeted across 2024 and 2025, linked with high confidence to Candiru — the Israeli spyware firm the US government blacklisted in 2021, now operating as Integrity Labs. Al Jazeera's own security team first noticed unusual patterns on journalists' devices in 2024.
How it worked, which is the whole story.
An ad bought by the Israeli ad-tech firm Discover-Tech wins an ordinary real-time ad auction and renders on your screen. You don't have to notice it, let alone touch it.
A script inside the ad quietly calls Discover-Tech's server, handing over your advertising ID or cookie ID and your IP address.
The server checks whether you are the person it is looking for.
If you are not, it returns an empty response. Zero bytes. Nothing happens. The ad is just an ad.
If you are, it returns JavaScript that runs automatically, and the infection chain begins.
That is the elegance of it. The same advertisement is completely harmless to everybody except one person, and it is the advertising system itself — built to sell shoes — that performs the identification.
The scale. Citizen Lab analysed about four billion bid records from March to June 2026. Discover-Tech's platform bid on roughly 3.77 billion ad impressions and won about 442 million. Around 719 million of its bids — about 19% — carried the script tag involved. Those ads appeared across roughly 75,000 apps and 120,000 websites.
Impressions landed on networks belonging to governments, militaries, NATO, the UN, the EU, critical infrastructure and media organisations. Confiant, the ad-security firm that worked on this, found Discover-Tech ads in networks used by the Pentagon, the IAEA and the International Criminal Court.
Read that carefully, because it is the easiest thing to overstate. Citizen Lab is explicit: an ad impression is not an infection. Those numbers describe where the ads were shown, not where spyware was installed. The confirmed infections are the Al Jazeera devices.
The part that should worry the industry. Discover-Tech was not operating in the shadows. It was a certified vendor with Google and an approved vendor with IAB Europe — the industry's own standards body — which is precisely what let it bid at that scale. Both removed it in early October 2026.
Discover-Tech was founded in 2020 and presents itself as a normal advertising company. Its platform lets customers target named individuals by advertising ID, cookie ID or IP address.
