Online advertisements can now serve as a delivery route for sophisticated spyware that infects devices without users clicking a link or downloading a file.
A report published by the University of Toronto’s Citizen Lab on October 15, 2026, documents how an advertising technology company allegedly helped spyware operators target devices through ordinary ads displayed on websites and mobile apps.
The investigation linked the technique, named AdFection, to attacks involving at least 45 devices at international news network Al Jazeera in 2024 and 2025.
The findings raise concerns about how advertising systems can be abused to deliver surveillance tools to specific individuals. They also expose gaps in an online advertising industry that routinely uses personal and device data to decide which ads people see.
How Ads Become a Spyware Delivery Route
The investigation identified Discover-Tech, an Israeli advertising technology company, as a link between online advertising platforms and commercial spyware operators. Citizen Lab said the company operates a platform called Controlium that can identify devices, build profiles of their users, and help select targets for spyware attacks.
Online advertising typically involves automated auctions that match advertisers with audiences based on available information about users and their devices. During this process, advertising systems can receive data such as IP addresses, device identifiers, and location information.
According to Citizen Lab, Discover-Tech abused this infrastructure to deliver malicious code to selected devices when an advertisement appeared. The code could retrieve additional instructions, including a browser exploit capable of installing spyware.
This means a targeted person does not necessarily need to click the ad, open a suspicious message, or even approve a download. Simply loading a website or app that displays the malicious advertisement can trigger the attack if the device is vulnerable to the exploit being used.
Al Jazeera Devices Targeted by the Campaign
Citizen Lab linked the campaign to Candiru, an Israeli spyware developer that has since been associated with the name Integrity Labs. The researchers found technical evidence connecting the advertising operation to spyware infrastructure associated with Candiru.
The investigation then identified at least 45 devices at Al Jazeera that were infected in 2024 and 2025. The findings demonstrate how advertising technology can be used to deliver targeted surveillance tools to people working at a media organisation.
However, the scale of the advertising activity does not mean every device that received one of the company’s ads was infected. Citizen Lab’s analysis found that Discover-Tech’s advertising activity extended far beyond the devices linked to the Al Jazeera attacks.
Millions of Devices Exposed to the Advertising Infrastructure
The researchers analysed approximately four billion advertising bidding records associated with Discover-Tech between March and June 2026, with the records showing that its ads appeared across more than 120,000 websites and 70,000 mobile apps.
Some of the advertising activity also appeared on networks associated with government agencies, military organisations, and critical infrastructure. However, the presence of an advertisement on these networks does not establish that the devices connected to them were compromised.
Still, the scale of the operation highlights the challenge of identifying malicious activity within legitimate advertising systems. Advertisements can pass through several companies before reaching a user’s device, making it difficult to determine who supplied the code or whether an ad is being used for surveillance.
Google and Other Platforms Respond
Following the investigation, Google blocked Discover-Tech from its advertising platforms after working with Citizen Lab and cybersecurity company Confiant.
Beeswax also removed the company from its platform, while IAB Europe suspended it from its approved vendor list.
What This Means for Device Security
The findings show why avoiding suspicious links alone cannot prevent every spyware attack.
Users can reduce their exposure by keeping their operating systems, browsers, and apps updated and using reputable ad-blocking tools. Limiting advertising tracking can also reduce some of the data available for targeting, although it does not guarantee protection against these attacks
For people who may be targeted because of their work, such as journalists and everyday people, the risk is particularly concerning because an infection may occur without any obvious warning.
This situation leaves an important question for the media and advertising industry to answer – how can advertising platforms prevent malicious code from reaching users when the attack can begin with an ordinary ad impression?
