Most people encounter online advertising as background noise: a banner, a sponsored listing, a video that begins before the page has finished loading. On October 15, the University of Toronto’s Citizen Lab reported that the same machinery can serve a more serious purpose.
Researchers documented what they call “AdFection,” a method for delivering mercenary spyware through targeted advertisements without requiring the victim to click, download or open anything. The finding is significant. But the most important part is not simply that spyware can arrive through an ad.
It is that the advertising supply chain supplied the targeting, identity and delivery mechanisms needed to make a sophisticated intrusion look like routine commerce.
An ad can be more than an image
Modern advertising is not a single file moving from an advertiser to a website. A real-time auction may involve a publisher, supply-side platform, demand-side platform, exchange, identity provider, measurement service and several other intermediaries. The visible creative is only the part the user can see.
When an ad renders, it may also contact outside servers, transmit advertising identifiers and device information, and load additional code. That code can examine the browser or device, communicate with another system and make decisions about what to do next.
Citizen Lab says Discover-Tech operated an advertising platform called Controlium that could receive advertising identifiers and IP information, fingerprint devices, distinguish potential targets and selectively return JavaScript. A seemingly ordinary ad could therefore become the first stage in a targeted intrusion.
The distinction matters because the advertisement itself did not necessarily contain the exploit. The visible creative and the malicious code could be separated. That made the activity harder for advertising platforms to inspect and easier to present as an ordinary transaction.
“Zero-click” does not mean “no vulnerability required.” It means the victim does not need to take an action. The browser, application or operating system still has to execute code, and the attacker still needs an exploit capable of turning that execution into access.
What the investigation found
Citizen Lab analyzed almost four billion Discover-Tech bidding records covering four months. The advertisements were associated with nearly 200,000 websites and Android or iOS applications in dozens of countries. Researchers observed the ads in services including weather, dating, language-learning, calling and mail applications, as well as on major websites.
That number should not be converted into a claim that millions of people were infected. An ad impression is not proof of targeting, exploitation or spyware installation. It does, however, demonstrate the potential reach of the delivery system.
The investigation also identified a more concrete infection sequence. Logs provided by Al Jazeera showed devices contacting Discover-Tech infrastructure, then a Candiru validator server and ultimately a Candiru command-and-control server. Citizen Lab said at least 45 devices within Al Jazeera were targeted during attacks in 2024 and 2025, and linked the infections to Candiru spyware with high confidence.
Candiru has been associated with mercenary surveillance operations targeting journalists, activists, officials and other sensitive individuals. Citizen Lab says the company is now reportedly operating under the name Integrity Labs. The research does not identify the government or intelligence customer that may have commissioned the attacks.
A parallel Confiant investigation found a related JavaScript framework capable of device fingerprinting, encrypted communications and operator-directed code execution. Confiant did not capture a complete exploit chain in the wild. Its evidence therefore supports the existence of a sophisticated delivery and staging system, not the claim that every observed ad infected a device.
The useful part of advertising for an attacker
Advertising systems are attractive to surveillance operators for the same reason they are attractive to marketers: they are built to identify and reach particular devices at scale.
An attacker may not need to compromise an entire website. The operator can wait for a target device to appear in an eligible auction, deliver an apparently normal advertisement, gather technical information and send additional code only when the device appears worth pursuing.
That is more selective than conventional malvertising, which often seeks to redirect or trick as many users as possible. It is also less visible. A failed exploit may leave behind only a network connection or a fingerprint. A successful profiling operation may never produce a warning, a crash or a noticeable change in the user’s experience.
The same system that helps advertisers decide whether a user belongs to a valuable audience can help an attacker decide whether a device belongs to a valuable target set.
Approval is not the same as security
Citizen Lab reported that Discover-Tech appeared on Google advertising registries and the IAB Europe Global Vendor List, and held a “Verified by TAG” designation during the period examined. Following the investigation, Google and IAB Europe removed the company from their lists. Google and Beeswax also terminated its access to advertising systems, while other companies paused or blocked related accounts and domains.
The response raises a straightforward question: what did the approval systems actually verify?
Identity verification is not malware screening. Contractual eligibility is not security testing. Privacy compliance is not operational monitoring. A vendor can pass one of those checks while failing another.
It is possible for a company to have a recognizable corporate identity, comply with paperwork requirements and still use its access to collect information or deliver code in ways that the approval process was not designed to detect.
The industry response also appears to have followed external research rather than preceding it. Removing a vendor after evidence is assembled is useful. It is not the same as demonstrating that comparable activity would be detected before a researcher found it.
The user sees one ad. The system contains many owners.
Responsibility is divided across the advertiser, advertising intermediary, demand-side platform, exchange, supply-side platform, publisher, application developer, browser, operating system, identity vendor and, in this case, the spyware operator.
That division creates a familiar accountability problem. The publisher may not write the code. The exchange may only route the bid. The platform may say the vendor passed onboarding. The browser may say it executed code according to its rules.
The user experiences none of those distinctions. The user sees an advertisement.
For publishers, this means advertising cannot be treated as entirely separate from the security boundary. A news organization may secure its content-management system, authentication service and internal network while allowing an opaque chain of third-party code to execute in the reader’s browser. An application may protect its own servers while accepting advertising software with access to device information and runtime behavior.
That does not mean every publisher should immediately remove advertising. It does mean that “the ad was supplied by a certified vendor” is an incomplete security answer.
What this means for ordinary users
There is no single setting that solves this problem. Ad blockers can reduce exposure to third-party advertising code, but they cannot repair an advertising ecosystem that organizations do not fully understand. Keeping browsers, operating systems and applications updated remains important because the delivery mechanism still depends on technical vulnerabilities. It is not a complete defense against an unknown exploit.
The most effective changes are organizational. Publishers and app developers need to know which domains and scripts their advertising partners can load, what logs are retained and how quickly a vendor can be removed. They should be able to identify the difference between an ad impression, a script execution, a suspicious outbound connection and a confirmed compromise.
Security teams should also consider advertising telemetry when investigating a device that contacted suspicious infrastructure. The absence of a click does not rule out compromise, and the absence of visible disruption does not establish safety.
The larger security boundary
This investigation belongs to the same family of problems as other modern technology failures: a system is treated as a collection of separate components even though the risk crosses the boundaries between them.
A security appliance is not secure merely because its software was patched. A contractor’s network is not outside a utility’s security boundary merely because the contractor is a separate company. A cellular system can protect confidentiality while still failing availability. An advertising system can verify vendors while failing to establish what code a user’s device will execute.
Those are not abstract distinctions. They determine who can see a device, who can send it instructions, who can detect misuse and who is responsible when the chain fails.
Citizen Lab’s findings do not establish that ordinary users were broadly infected, that every Discover-Tech advertisement contained spyware or that every advertising platform knowingly enabled surveillance. They do establish a technically credible mechanism, a real-world infection set and a supply chain that allowed a company linked to spyware delivery to operate at substantial scale.
The failure was not simply that one malicious advertisement slipped through. The deeper failure was that the advertising system had enough access, information and trust to make a sophisticated intrusion look like routine commerce.
