On October 15, the University of Toronto's Citizen Lab published what it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. Nobody clicked a link or opened a file. An ad rendered on screen, and Candiru spyware landed on at least 45 devices tied to Al Jazeera. If you buy programmatic media, the same pipes your ads travel through served as the delivery truck.
What Citizen Lab and Confiant Found
Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert wrote the report, Citizen Lab Report 195, while ad security firm Confiant ran a parallel investigation. The researchers named the technique "AdFection."
At the center sits Discover-Tech, an Israeli company that presented itself as an ordinary ad business. According to the report, it ran a platform called Controlium that let spyware partners fingerprint and infect a device the moment an ad loaded. Its demand side platform, MyDSP, bid on 3,770,286,576 impressions between March and June 2026 and won 441,954,291 of them, an 11.7% win rate. Ads carrying the attacker's script tags reached users of 75,373 apps and 120,768 websites. Total spend over those four months came to about $109,091.
Read that last number again. Roughly $109,000 bought a surveillance net covering close to 200,000 apps and sites. The report puts it bluntly: "the simple display of a targeted ad is enough for infection."
Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020. Both removed it in early October. Beeswax, Vungle (Liftoff) and Eskimi also cut it off.
What It Means for Marketers
Most advertisers will never touch a spyware vendor. The trouble is that the infrastructure serving your retargeting ad also served this one. Every bid request ships IP addresses, device IDs and location signals to dozens or hundreds of companies per impression. Discover-Tech read that same stream with a different goal in mind.
European regulators already scrutinizing real-time bidding now have a documented case of the bidstream turned into a weapon. Publishers will likely get stricter about which buyers can run scripts inside their inventory, and that will squeeze smaller DSPs and resellers first.
For a business owner, the practical move is to know exactly where your money flows. Ask your agency or platform for the full list of DSPs and exchanges in your supply path. Push for supply path optimization that cuts resellers nobody can name. Put more weight on first party data you collect yourself instead of rented audience segments, which gives you better targeting and fewer strangers in the chain.
Tools like KenjiAI (kenjiai.com) are built for exactly this kind of shift, helping businesses capture leads and run follow up on channels they own, so less of the funnel depends on anonymous bidstream data.
What to Watch Next
Three things matter over the coming weeks.
- Citizen Lab says a separate report on DARK CARTOGRAPHER, a threat actor that links advertising IDs to phone numbers, is on the way. That one could hit the data broker market harder than this one.
- Watch Yandex. Its exchange carried 67.4% of MyDSP's bids, against 24.74% for Google, and it does not appear among the companies that took action.
- Watch the vendor registries. If IAB Europe's framework approved Discover-Tech for six years, every other approved vendor list deserves an audit, and brands should ask partners what vetting actually happens before a buyer gets access.
Ad tech has argued for years that bidstream data is harmless because it is anonymous and fleeting. Citizen Lab just showed what a $109,000 budget can do with it.
Source: Citizen Lab, "How Discover-Tech Turned Targeted Ads into a Pipeline for Spyware" (October 15, 2026)
Published by the Media Traffics | KenjiAI team. kenjiai.com
Top comments (0)