EDITION OF OCTOBER 16, 2026
AdFection: targeted advertising implicated in an espionage campaign
According to a Citizen Lab investigation reported by Ars Technica, targeted advertisements were used to infect devices without user interaction. The documented case at Al Jazeera highlights the risks associated with advertising intermediaries, while several platforms have removed or suspended the provider’s access.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
A Citizen Lab investigation, reported by Ars Technica, describes how targeted advertisements allegedly enabled spyware to be installed without a click. The confirmed infections at Al Jazeera date to 2024 and 2025. The findings implicate an advertising intermediary and raise questions about platform controls.
Targeted advertising can also become a channel for delivering spyware. In an article published on October 15, Ars Technica reports on an investigation by the University of Toronto’s Citizen Lab into a campaign dubbed AdFection. The laboratory says it confirmed the infection of 45 devices at Al Jazeera in 2024 and 2025. The attacks affected iOS and Android devices without requiring a click: loading a page or opening an application could be enough to trigger an infection.
According to the laboratory’s findings as reported by the outlet, the advertisements were supplied by Discover-Tech, an Israeli company that presents itself as a legitimate advertising business. Citizen Lab attributes to it an intermediary role between advertising networks and partners in the mercenary spyware industry. The malware deployed in this campaign was reportedly developed and distributed by Candiru, renamed Integrity Labs.
The mechanism described uses advertising targeting to reach profiles sought by Candiru’s clients. The ads contained code that could contact Candiru’s control servers. Those servers then delivered an exploit when the advertisement appeared on the targeted device. Audience selection thus became a step in the infection chain, according to the investigation.
Citizen Lab also says it obtained more than 4 billion advertising auction records processed by Discover-Tech. They show that its ads appeared in more than 70,000 mobile applications and on more than 120,000 websites between March and June 2026. These volumes describe an advertising presence: they are not a count of infections. This distinction limits what can be concluded about the actual extent of the espionage.
Ars Technica reports that Google and IAB Europe removed Discover-Tech from their advertising vendor registries. Google also revoked its access to its advertising exchanges, while Beeswax removed it from its buying platform. These measures respond to the intermediary’s alleged involvement, without in themselves establishing that all the distribution channels concerned have been neutralized.
A technical limitation remains: the investigation describes neither the vulnerabilities exploited nor the software ultimately installed. It would therefore be premature to infer precisely which devices remain exposed. Above all, the case calls for scrutiny of intermediaries’ responsibility and platforms’ ability to detect misuse of their targeting tools.