Citizen Lab Finds Spyware Delivered Through Targeted Ads

An online advertisement can do more than track the person who sees it. In a newly published investigation, the University of Toronto’s Citizen Lab says it has documented spyware infections triggered when a targeted ad appeared on a device, with no click required. The researchers call the technique “AdFection” and link attacks against devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered through ad infrastructure operated by a company called Discover-Tech.

This is a significant escalation from the familiar warning not to click suspicious links. The research describes a route through the ordinary machinery of programmatic advertising, where an ad is selected and delivered in a fraction of a second. A person could be browsing a legitimate site or using an app when the ad is shown. In the cases Citizen Lab investigated, the display itself was enough to begin the infection chain.

Advertisers often buy access to audiences through real-time bidding. Those auctions use identifiers and other signals to decide which device receives which ad. Citizen Lab says Discover-Tech used that system both to profile potential targets and to put executable code in front of selected devices. Its analysis identifies an ad tag that called back to a server under Discover-Tech’s control. The server could return code to a device matching a target and an empty response to everyone else, making the malicious activity harder for ad platforms to observe.

The researchers say network evidence, infrastructure fingerprints and the behaviour of the implant connect the Al Jazeera attacks to Candiru. They describe this as the first public technical confirmation of mercenary spyware being delivered through targeted ads in the wild. That finding does not mean every ad is dangerous or that everyone who visited an affected website was infected. It does show that the advertising supply chain can be turned into a precise delivery mechanism against particular people.

According to Citizen Lab, Google worked with the investigators, removed Discover-Tech from its vendor registries and terminated its access to Google’s ad exchange platforms in early October. The Interactive Advertising Bureau’s European branch also removed the company from its vendor list. Other ad companies described in the report removed, paused or blocked Discover-Tech’s access. Citizen Lab says Discover-Tech and Candiru did not respond to its requests for comment within the publication deadline.

The case raises a difficult question for platforms that certify advertising vendors. A company able to pass through trusted ad systems can reach ordinary websites and apps at scale, while highly selective targeting can leave little visible evidence. The industry’s response to Discover-Tech may stop this particular operation, but the underlying weakness is broader: opaque ad auctions, abundant device data and code that can change depending on who is viewing it.

TechBooky has previously covered how mercenary spyware can enter a phone without the owner realising it. This new investigation shifts attention from messaging and malicious links to the ad systems that finance much of the open web. For journalists and other people at heightened risk, the finding is especially concerning. For the wider public, it is a reminder that security cannot be reduced to telling users to be careful about what they click when an attack may require no click at all.