Story discussed in latest podcast episode 61:
For about twenty years, the most basic piece of security advice anyone has given you is four words long.
Don't click the ad.
It was good advice. It's also, as of last week, not enough.
On October 15th, Citizen Lab at the University of Toronto published a report on an Israeli company called Discover-Tech. On paper, Discover-Tech is an ordinary ad-tech firm. It buys ad space. It runs campaigns. It had been on Google's lists of approved ad vendors since 2020.
According to Citizen Lab, it was also a delivery service for mercenary spyware. Its product was the ability to pick a specific person out of the global advertising system, show them an ad, and use that ad to infect their device.
Citizen Lab calls the technique AdFection. It is, in their words, the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
Zero-click is the part I want you to sit with. You didn't have to tap anything. The ad just had to load.
How it works
The uncomfortable thing about AdFection is how little of it is exotic. Almost all of it is the advertising system working exactly as designed.
Every time a page or an app has an ad slot to fill, it runs an auction. Your device's details get broadcast to bidders: an advertising ID, a cookie ID, an IP address, what app you're in, roughly where you are. Bidders decide in milliseconds whether you're worth showing an ad to. That's real-time bidding, and it happens billions of times a day.
Discover-Tech bought its way into those auctions through the same pipes that sell you shoes. Citizen Lab names Google, Yandex, Liftoff's Vungle and Sunteng as exchanges it reached through its own buying platform, plus Beeswax and Eskimi bought separately.
Here's what happened when one of its ads won:
- The ad loads on your device. Inside it is a small script that points back to a Discover-Tech server.
- The script phones home with your advertising ID or cookie ID. The request also carries your IP address.
- The server checks you against a target list.
- If you're not on it, the server sends back nothing. Literally a zero-byte response. The ad is just an ad.
- If you are on it, the server sends back code that runs automatically and can load the spyware.
That fourth step is the clever part, and it's why this got through. The ad networks only ever saw the harmless version. The ad creative was clean. The script was a few lines that fetched something from a server. The payload only existed for the people it was meant for, and it was served directly to them, outside anything the exchange would ever inspect.
Customers using Discover-Tech's platform could pick their target by mobile advertising ID, browser cookie ID or IP address, and limit where ads ran by country, app or website.
Read that list again. Every one of those is something the ad industry has spent a decade building out, so it can tell advertisers exactly who they're reaching. It turns out that's also exactly what you need to aim an exploit.
Who was hit
Citizen Lab confirmed that at least 45 devices belonging to Al Jazeera were targeted in a series of attacks across 2024 and 2025. Al Jazeera recovered a sample from one of the compromised machines, a Windows DLL, and Citizen Lab attributes it with high confidence to Candiru, an Israeli spyware vendor that has since been rebranded as Integrity Labs.
Note that it was a Windows machine. This is not only a phone problem. Anything that renders ads is in scope.
Then the researchers found something else. Discover-Tech had left part of its infrastructure exposed to the open internet, and it held nearly four billion bidding records covering March to June of this year.
Those records show where the ads went:
- Ads carrying the attacker's script tag ran in 75,373 apps and 120,768 websites.
- Discover-Tech bid to show those ads to users in 161 countries, going by IP address.
- Impressions landed on networks belonging to governments, militaries, NATO, the UN, EU institutions, critical infrastructure, semiconductor and defense-tech firms, and media organizations.
And here's the caveat, and it matters, because this story will get exaggerated: an ad reaching someone does not mean their device was infected. Citizen Lab says it plainly: an ad impression "does not in and of itself confirm targeting or infection with spyware." Unless a device was on a target list, the server sent back nothing. The ad loaded, the server said "not you," and nothing happened.
What the data shows is reach. It shows that this system could put a script in front of almost anyone, inside some of the most sensitive networks on earth, and decide quietly, one device at a time, who got the payload.
The rest of the cast
Candiru wasn't Discover-Tech's only connection. Citizen Lab also ties it to:
- Bindecy, another Israeli spyware vendor, with products named "Archer" and "Cupid."
- Intelos, which sells what the industry calls ADINT, advertising intelligence. It's surveillance built from ad data. One of its shareholders was also a Discover-Tech director.
- The Intellexa network. Until March 2026, one of Discover-Tech's shareholders was a company linked to the person who managed the corporate network behind Intellexa, the group that sells Predator spyware.
That Intellexa thread isn't random. Late last year Amnesty International documented leaked Intellexa marketing files describing an ad-based infection method called "Aladdin," used to deliver Predator. The idea of infecting people through ads has been on the spyware industry's sales slides for a while. AdFection is the first time anyone has publicly shown it working.
Then there's the one I'll be watching closest. Citizen Lab describes a separate actor it calls Dark Cartographer, which it says used Discover-Tech's infrastructure to match advertising IDs to real phone numbers by exploiting leaks at mobile carriers in more than 30 countries, active since at least 2019. A full report on that is still coming.
If you've ever been told your advertising ID is "anonymous," that's what anonymous is worth. Somebody built a way to put a phone number on it.
The fallout
Once Citizen Lab and Confiant (an ad-security firm that published its own investigation alongside the report) brought this to the industry:
- Google, which collaborated on the investigation, terminated Discover-Tech's access to its ad exchange platforms.
- Google and IAB Europe both removed it from their ad vendor registries in early October.
- Beeswax removed it from its platform, and Eskimi blocked its accounts and domains.
- Liftoff's Vungle paused its access pending a review.
- Microsoft's Xandr, Bindecy and Intelos didn't respond to Citizen Lab.
That's a decent response, and it's worth saying so. But notice what it is. It's every company removing one vendor. Nobody announced a change to how the auction itself works, because the auction itself worked fine. That's the problem.
Who is Candiru?
If the name sounds familiar, it should. Candiru has been one of the industry's most persistent names, mostly because nothing has managed to stop it.
- Founded in Tel Aviv in 2014. It sells hacking tools to governments.
- It changes its name a lot. Four times in six years by Citizen Lab's count, including registering as Saito Tech. The original name comes from a parasitic Amazon fish. They picked it themselves.
- It isn't cheap. Contracts are reported to run into the tens of millions of dollars. One leaked proposal Citizen Lab described was €16 million for unlimited infection attempts but only 10 devices monitored at a time, with more devices and countries sold as add-ons.
- 2021: Citizen Lab and Microsoft exposed its spyware, which Microsoft calls DevilsTongue, on at least 100 victims worldwide, including journalists, activists, politicians and dissidents. Microsoft patched the Windows zero-days it was using.
- November 2021: the US Commerce Department added Candiru to the Entity List, its trade blacklist, alongside NSO Group, the makers of Pegasus.
- 2022: Avast caught Candiru using a Chrome zero-day against journalists in Lebanon, and Citizen Lab's CatalanGate investigation found Candiru used against figures in the Catalan independence movement.
- 2025: Candiru was reportedly sold to a US investment firm, Integrity Partners, for up to $30 million, and its staff and assets were moved into a new entity that isn't on the Entity List. Citizen Lab now refers to it as Candiru/Integrity Labs.
So here's the arc. Sanctions slowed Candiru down. They didn't stop it. It got a new owner, a new corporate shell, and, as of this report, a new delivery mechanism. That mechanism is ordinary ads, and there's no patch for it.
What to do
None of this is a reason to panic. If you're an ordinary person, you're very unlikely to be on a target list that costs tens of millions of dollars to run. But almost everything below is good hygiene against the ordinary ad-tracking machine too, and that machine has your details whether you're a target or not.
Kill your advertising ID.
- iPhone: Settings → Privacy & Security → Tracking. Turn Allow Apps to Request to Track off.
- Android: Settings → Privacy → Ads → Delete advertising ID. On some phones it's under Settings → Google → Ads.
- GrapheneOS: without Google Play services there's no Google advertising ID to give out at all. This is one more reason it's the platform I keep pointing people at.
Stop the ad code from loading in the first place. This is the big one, and it's more important than resetting an ID, because Discover-Tech could also target by IP address and cookie. If the ad never loads, the script never phones home.
- Filter at the network level with DNS blocking: NextDNS, a Pi-hole on your home network, or a VPN with built-in ad and tracker blocking.
- On desktop, run a real content blocker in the browser, like uBlock Origin. Remember, the confirmed Al Jazeera sample was a Windows DLL.
If you're higher-risk, turn on Lockdown Mode. If you're a journalist, an activist, in government, or close to any of those people, turn on Lockdown Mode on your iPhone, iPad and Mac. It strips back exactly the kind of complex web technology that zero-click exploits depend on. That's what it was built for.
Keep everything updated. Spyware chains run on unpatched bugs. Browser and OS updates are the cheapest defense you have.
What I'd take from this
For years the privacy community has been saying that ad-tech and surveillance are the same industry wearing different badges. It usually comes across as a slogan, which made it easy to wave away.
This report makes it concrete.
The data used to sell you shoes is the same data used to find you. The auction that decides which ad you see is the same auction that decided who got the exploit. Nothing had to be hacked to make this work. The plumbing was already built, and somebody plugged a spyware vendor into it.
Every ad you see is the result of an auction where your device's details are broadcast to dozens of companies you've never heard of. Most of them just want to sell you something.
This is what happens when one of them doesn't.
Block the ads. Not because they're annoying, but because they're a door into your device.
— Simon
Sources & further reading
- How Discover-Tech Turned Targeted Ads into a Pipeline for Spyware — Citizen Lab, University of Toronto (primary report, October 15, 2026)
- Targeted ads installed Candiru spyware in zero-click attacks — BleepingComputer (news coverage)
- Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus — Citizen Lab (2021 DevilsTongue investigation)
- Tracking Candiru's DevilsTongue Spyware in Multiple Countries — Recorded Future Insikt Group (August 2025)
- The Return of Candiru: Zero-days in the Middle East — Avast Threat Labs, now Gen Digital (July 2022 Chrome zero-day, CVE-2022-2294)
- Candiru Spyware Caught Exploiting Google Chrome Zero-Day to Target Journalists — The Hacker News (July 2022)
- Candiru (spyware company) — Wikipedia (background and corporate history)