Citizen Lab Says It Confirmed Spyware Delivered by Targeted Ads for the First Time
Citizen Lab, a research group at the University of Toronto, reported Oct. 15, 2026, that spyware was installed on devices at the news network Al Jazeera through targeted online advertisements. The group says the infections needed no click, no message and no file to open. The ad only had to be displayed.
That delivery route is the reason the finding matters beyond one newsroom. Citizen Lab names an advertising company, Discover-Tech, as the channel, and says the spyware came from Candiru, a surveillance vendor now trading as Integrity Labs. The group describes its work as the first public technical confirmation that commercially sold spyware has been delivered through targeted ads, and calls the technique AdFection.
The report puts a scale on the advertising operation. Citizen Lab says it analyzed about four billion bidding records from a Discover-Tech server and found that, over four months, the company's ads ran on almost 200,000 websites, and Android and iOS apps, in dozens of countries.
Citizen Lab also says Discover-Tech sat inside the mainstream of the ad business: it appeared for years on lists of approved or certified vendors kept by Google and the trade body IAB Europe, and its ads were served through networks including Google, Yandex and Beeswax.
Citizen Lab says Google and IAB Europe dropped Discover-Tech from their vendor registries in early October 2026, and that Google ended the company's access to its ad exchanges. The group says Beeswax removed it from its buying platform, Vungle (Liftoff) paused its access pending a review, and Eskimi blocked its accounts and domains. Citizen Lab wrote to 13 companies and says some did not reply within the time it allowed.
The report is credited to Bill Marczak and Ron Deibert of Citizen Lab and colleagues, and appeared alongside a separate investigation by Confiant. Citizen Lab says a second operator it is still examining used Discover-Tech's infrastructure to tie advertising identifiers to phone numbers, and that it will set out those findings separately.
