Citizen Lab Exposes 'AdFection': Government Spyware Delivered via Online Ads, First Technical Confirmation

What happened

On Oct 15, the University of Toronto's Citizen Lab published the full 'Exposing AdFection' report, detailing how Israeli ad firm Discover-Tech turned its ad-bidding system into a spyware delivery tool. The report draws on exposed source code, login records and billions of bidding logs from the company's website, with assistance from ad-quality firm Confiant.

The report confirms that at least two zero-click spyware makers used the platform: Candiru and Bindecy. Between 2024 and 2025, at least 45 Windows computers at media organization Al Jazeera were infected with Candiru's spyware after being exposed to online ads packed with malicious code. Citizen Lab says it is unclear which governments were behind the attacks, but this is the first confirmed case of government-backed zero-click spyware delivered through online ads.

Researchers also found that Discover-Tech had left part of its login-page source code exposed, letting them recreate Controlium's web dashboard without logging in. A publicly accessible part of its site leaked Controlium user login records (including credentials of at least two Candiru employees) and billions of ad-bidding records. The bidding records show that between March and June 2026 its ads appeared across tens of thousands of mobile apps and websites, and were shown on devices inside military, government, critical-infrastructure and national cyber-agency networks. Ad-quality firm Confiant, which assisted the investigation, found evidence that suspected malicious ads also appeared on devices inside the IAEA and International Criminal Court networks.

There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action.

— Bill Marczak, senior researcher at Citizen Lab (reported by TechCrunch)

Key facts

1. Delivery channel: online ads; zero-click, no victim interaction required
2. Bridge platform: Controlium, the ad platform of Israeli company Discover-Tech
3. Spyware vendors: Candiru and Bindecy, two zero-click spyware makers
4. Known victims: at least 45 Al Jazeera Windows computers (2024–2025)
5. Scale: ads appeared across tens of thousands of apps and websites in Mar–Jun 2026; touched devices on military, government, critical-infrastructure, IAEA and ICC networks (per the report and Confiant's investigation)
6. Responses: Al Jazeera and Discover-Tech did not respond to requests for comment; Candiru maker Integrity Labs could not be reached (per TechCrunch)