Zero click spyware in ads has now been documented in the wild, after Citizen Lab said on October 15, 2026 that Discover-Tech ad impressions infected Al Jazeera devices with Candiru spyware. Citizen Lab calls the technique AdFection and published it as Citizen Lab Report 195. Wired reported the same day that Citizen Lab believes this is the first publicly released detailed technical evidence of sophisticated spyware infecting devices through digital ads.
The operational change for the ad market came in early October 2026, when Google and IAB Europe removed Discover-Tech from ad vendor registries, according to Citizen Lab's own report. Citizen Lab also says Beeswax removed Discover-Tech, Vungle paused access, and Eskimi blocked its accounts and domains. The Verge reported on October 15 that Citizen Lab and Confiant found Discover-Tech's Controlium platform let spyware partners profile users and select them for infection by IP address, mobile ad ID, or browser identifier.
How zero click spyware in ads worked
Zero-click spyware in ads worked by using a normal ad impression as the delivery path, then deciding server-side whether the device matched a target. Citizen Lab says Discover-Tech ads could send identifiers such as IP address and ad-related device identifiers into infrastructure tied to spyware delivery. If the device matched a target, the system could return exploit code without a click, download, form fill, or visible warning. Bill Marczak, senior researcher at Citizen Lab, told Wired, "AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet."
The mechanism depends on real-time bidding because ad auctions already move device, context and placement data through multiple ad tech systems within milliseconds. Citizen Lab says Discover-Tech operated Controlium, which could be used to de-anonymize, fingerprint and automatically infect devices once an ad appeared. The important limit is scope. Citizen Lab's executive summary says its visibility into Discover-Tech impressions is limited to data from Discover-Tech's MyDSP platform, so the report does not measure the whole ad ecosystem.
What the evidence proves
The evidence proves infection at Al Jazeera and broad ad delivery by Discover-Tech, but it does not prove that every Discover-Tech impression carried spyware. Citizen Lab says Al Jazeera devices were infected with Candiru spyware in 2024 and 2025 and that it linked those attacks to Candiru with high confidence. The primary-source wording matters because some coverage describes devices as targeted, while Citizen Lab's own report says infected. Wired reported that 45 devices belonging to Al Jazeera were targeted with zero-click attacks delivered by ads.
Citizen Lab's narrowest finding is that Discover-Tech impressions created a path from ad delivery to profiling and, for selected devices, infection with Candiru-linked spyware. Its broader measurement found almost 200,000 unique websites and Android or iOS apps in four billion Discover-Tech bidding records over four months, but Citizen Lab says an impression alone does not confirm spyware targeting or infection.
The unresolved facts are material for marketers and publishers. Citizen Lab says it found no evidence that Discover-Tech was engaged in legitimate advertising activity, but it also says Discover-Tech ads were observed in well-known apps and sites without saying those publishers were compromised. Wired reported that Discover-Tech and its CEO did not respond before publication, and that Integrity Partners, believed to own Candiru's assets after US sanctions in 2021, also did not respond. On r/StopBadBots, one October 15 post treated the report as proof that browsing ad-supported pages creates unacceptable device risk, but that post is practitioner reaction, not evidence of additional infections.
What ad platforms changed
Ad platforms changed vendor access rather than the architecture that made AdFection possible. Google blocked Discover-Tech from its ad platforms and set up Safe Browsing warnings for websites linked to the group, according to Wired. IAB Europe suspended Discover-Tech from the Global Vendor List, and Citizen Lab says several exchanges or platforms also acted in early October 2026.
| Entity | Action reported | Source |
|---|---|---|
| Removed Discover-Tech from ad platforms and added Safe Browsing warnings for linked sites. | Wired and Citizen Lab | |
| IAB Europe | Suspended Discover-Tech from the Global Vendor List after an audit. | Wired and Citizen Lab |
| Beeswax | Removed Discover-Tech from its platform after recent activity and third-party validation. | Wired and Citizen Lab |
| Vungle | Paused Discover-Tech access. | Citizen Lab |
| Eskimi | Blocked Discover-Tech accounts and domains. | Citizen Lab |
Those removals reduce Discover-Tech's access to named platforms, but they do not answer whether the same method exists through other ad companies. Wolfie Christl, senior Citizen Lab researcher, told Wired, "The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario." Citizen Lab's report points at customer vetting and ad ecosystem trust as the failure points, not a single publisher page or mobile app.
What marketers should audit now
Marketing and security teams should audit vendor access, placement records and high-risk device settings before treating this as only a national security story. In ad accounts, check whether Discover-Tech, Controlium, MyDSP, or reseller paths tied to those names appear in partner records, placement reports, log exports, or vendor approvals. In app and web buying, compare recent delivery against the platforms named in Citizen Lab's report and document whether Google, Beeswax, Vungle, Eskimi, or IAB Europe status changes altered spend, reach, or blocked inventory.
For people at higher risk of targeted spyware, The Verge reported that Citizen Lab and Confiant recommend ad blockers, disabled ad tracking, and regular mobile ad ID resets. That means a specific check, not a slogan. On iOS and Android fleets, confirm whether ad tracking settings and mobile advertising identifiers are controlled by mobile device management, and record when high-risk users last reset the identifier. For publisher and SEO teams, the matching check is reputational. If a page carried a Discover-Tech impression, the evidence does not say the page was hacked, so public incident language should distinguish ad supply chain exposure from site compromise.
What this means for search traffic
The search impact is indirect, because the evidence shows ad supply chain abuse rather than a Google Search ranking change. The likely effect for search and content teams is on user trust, paid media controls and citation quality in AI answers. If high-risk audiences block ads more aggressively after AdFection, paid campaigns and retargeting pools may lose measurable users, but the evidence does not quantify any traffic loss. If AI answer systems cite reporting on affected websites or apps, they should preserve Citizen Lab's caveat that an impression alone does not prove infection.
This matters for publishers whose domains appear in impression records. Citizen Lab's executive summary names sites and apps where Discover-Tech ads were observed, including BBC, The New York Times, CBC, AccuWeather, Yahoo Mail, Viber, Truecaller and DuoLingo, but that observation is not a finding that those publishers delivered spyware to every visitor. Search teams should avoid schema, FAQ copy, help center notices, or incident pages that collapse those facts into a stronger claim. The next trigger to watch is IAB Europe's pending decision on whether further confirmation justifies definitive expulsion from the Global Vendor List, along with any new Citizen Lab or platform disclosures naming additional vendors.