Ads that install spyware ran on 75,000 apps and 120,000 websites

A DSP that bid billions and sold nothing

Citizen Lab's report calls it "AdFection": the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads. An ad renders, contacts a server, and can receive code that infects the device with no tap. The researchers say Discover-Tech Ltd, an Israeli firm that presents itself as an ordinary demand-side platform (DSP, the software advertisers use to buy ad slots), acts as a facilitator for spyware vendors. The vendor on the other end of the Al Jazeera infections was Candiru, now rebranded as Integrity Labs.

The ad-buying numbers do not look like advertising. From about four billion bid records collected between March and June 2026, Discover-Tech ads showed up on roughly 75,000 apps and 120,000 websites. Its MyDSP platform won 442 million impressions, 11.7% of the 3.77 billion it bid on, and about 19% of bids involved ads with the script tags that deliver code. The recorded spend was only about $109,000, with essentially no advertiser revenue, and the "AliExpress" campaigns look unlikely to be genuine.

A control panel the researchers call Controlium lets customers target by mobile ad ID, browser ID or IP address. Its authentication flaw exposed 128 days of login logs for 120 usernames. Script-tag ads reached users in 161 countries, with Yemen drawing the most raw bids. Impressions also landed on networks of defense bodies, NATO, the UN and EU institutions, though the report stresses an impression is not proof of infection.

Discover-Tech had been listed as an approved vendor by Google and IAB Europe from 2020 to 2026. In October 2026 both removed it, Beeswax dropped it, Vungle paused access and Eskimi blocked its accounts.

Vetting is "virtually impossible", says an adtech engineer, and a billing question answers it

The loudest argument in the thread was about blame. An adtech engineer with 13 years in the industry argued that no single "ad provider" exists to hold liable, because the ecosystem is a maze of niches, and that even Google's pre-scanning lets bad actors through:

"The sheer volume of traffic makes it virtually impossible to vet even a fraction of it." — AdTech engineer, 13 years in the industry

The reply came from someone who had heard that structure of excuse in another industry. A commenter who dealt with telecom providers in a law-enforcement context described a meeting with a senior police official, a prosecutor and several telco reps, where the non-telco side kept returning to one question:

"Why is it not impossible then also to do billing?" — commenter who sat in on telco-versus-police meetings

Billing is the telco's own revenue, so it gets built; helping police only costs money. The same commenter applied that to ad networks: they could run systems that try to stop this, and it "would just reduce profits to do so."

The report documents a gatekeeper, not an exploit

The engineer's other complaint was about the report itself, which the engineer called "highly sensationalist" on "zero-click" because it never says what activates the malware. A MediaWiki contributor suspected an old bug sat behind the headline:

"It sounds like they are talking about CVE-2021-21166, but if they really are talking about an exploit from 5 years ago, i feel like their intro paragraph is rather misleading." — MediaWiki contributor

A commenter who went back to the report's own text found a reason for the gap. The researchers describe a "NOAS server" that each ad calls back to. It receives a cookie or mobile ad ID, and returns code only if the source IP and identifiers match a target. Otherwise it sends a 0-byte response.

"I suspect the CitizenLab report is light on details in particular because they don't actually know them" — commenter who re-read the report's own wording

So the AdFection finding is narrower than the headline and harder to dismiss. Citizen Lab caught the filter that decides who gets code, not the exploit that code carries, and by the report's account the filter exists to keep malicious code away from the companies that serve and display the ads.

State arm or mercenary vendor

One reading, from a commenter with 20k+ karma, was that companies everywhere end up acting in the interests of their security services, and Israel has plenty of ad-tech companies to rope in. Another commenter cut that off: "Except this isn't the security services they are serving it's a mercenary spyware vendor." The report itself makes no claim about a state operation.

The checkable part is the buyer

Payload-on-demand undercuts both arguments above. A creative scanner never sees code the server withholds, and a gatekeeper that returns zero bytes to most visitors looks clean to any reviewer who is not the target. What a platform can still verify is who is buying. One commenter offered the fix that survives that: "The solution is unfortunately for everyone a robust KYC regime." A check on who is buying is the one control raised in the thread that this design does not defeat.