Citizen Lab published "Exposing AdFection" on 15 October, calling it "the first-ever technical demonstration of in-the-wild infection" of devices with zero-click mercenary spyware delivered through targeted advertising.

It says it finds "with high confidence" that "devices at international media network Al Jazeera were targeted and infected" with Candiru's spyware by this method.

The chain is ordinary advertising until the last step

Citizen Lab sets it out in four steps. An Israeli company called Discover-Tech bids in real-time ad auctions to show an advert to a particular user. When the advert is shown, the user's advertising identifier and IP address are sent to Discover-Tech's servers. If that user has been selected, the device receives malicious JavaScript, which the browser or app runs. If not, nothing happens.

The fourth point is the one worth sitting with: the visible adverts do not contain exploit code. Citizen Lab says this helps conceal their purpose from the ad platforms, and it is why this is hard to catch by inspecting creatives. The advert is clean. The selection is the attack.

That inverts the usual advice about malicious advertising, which assumes a bad advert that everyone could receive. Here the advert is the delivery address, and the exploit is posted only to the address the buyer has already chosen.

We covered the commodity end of this in October, when an iOS exploit kit started arriving inside adverts. The same channel, bought at a different price.

Who is involved

Discover-Tech presents itself as an advertising business. Citizen Lab describes its platform, Controlium, as "a one-stop platform for mercenary spyware firms to infect targets via online ads". Its chief executive is named as Dekel Boni.

Candiru is a user of that platform, is reported to be owned now by Integrity Labs, and was placed on the US Commerce Department's Entity List. Bindecy and Intelos are linked to the platform.

The personnel links are the part that will travel. Eric Banoun sat on Discover-Tech's board from 2020 to 2025; he co-founded Circles and Senpai Technologies, both closely affiliated with NSO Group and Intellexa. A company linked to Sara Hamou, who managed Intellexa's corporate network, was a shareholder from 2020 to 2026.

Discover-Tech interfaced with Google, Yandex and Beeswax.

Where the adverts were seen, and what that does not mean

Citizen Lab analysed "billions of ad bidding records" and says Discover-Tech's adverts "directed millions of devices across dozens of countries" to contact its profiling and infection servers.

The impressions landed on government-operated networks in 24 countries, including Israel, Norway, Sweden, Denmark, Australia and Czechia; on networks of NATO, the United Nations and European Union entities; on media organisations in 8 countries, 19 institutions in all; on election oversight bodies in Armenia, Indonesia and Mexico; and on networks of Intel, Nvidia, Apple, Microsoft, Raytheon and Elbit Systems.

Citizen Lab then says the thing that most of the coverage of this report left out: "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware." It also notes its own visibility is partial — the data excludes Beeswax and Eskimi and "covers a limited time period".

So the only confirmed infections in this report are at Al Jazeera. Everything else is an advert that was served to a device on a sensitive network, which is a reason for those organisations to look and not a finding that they were compromised. Citizen Lab calls for "urgent investigation" to determine whether users on those networks were infected.

What already changed

Google and IAB Europe removed Discover-Tech from their ad vendor lists. Google and Beeswax terminated its access to their ad systems.

That is faster than this industry usually moves, and it is also the whole remedy available to an ad platform: the account is gone, the technique is not. Nothing in the chain Citizen Lab describes required a flaw in the advertising system. It required the ability to bid.

We have written before about Apple notifying targets of mercenary spyware across 110 countries and about a Pegasus case in Serbia where the flaw used had been patched eight months earlier. The pattern that connects them is that targets almost never find this themselves.

What to do

  • If you run a network that appeared in the categories above, the useful response is forensic: Citizen Lab is asking those organisations to check, not telling them they are infected.
  • For people at elevated risk — journalists, civil society, people who work on sensitive files — Lockdown Mode on Apple devices and Advanced Protection on Android remain the measures that actually constrain this class of attack.
  • Ad blocking is not a privacy preference in this threat model. It removes the delivery channel.
  • Organisations buying ad inventory for their own staff networks should know which exchanges and vendors are in the path. This is the first case where that question has a security answer.

What is not established

  • How many devices were infected. The executive summary gives no count; the figure of 45 devices that appears widely in coverage is not in it, and comes from the full report or from reporting on it.
  • The exact scale of the ad footprint. Figures of 120,000 websites and 70,000 apps circulate in coverage; the executive summary gives counts by category and does not publish those totals.
  • Which government client of Candiru's was behind the Al Jazeera targeting. Citizen Lab does not attribute it.
  • The exploit itself. Researchers recovered spyware from a device but not the browser or application exploit, so the initial compromise is described from the infrastructure rather than from captured code.
  • Whether any of the sensitive networks that received impressions were infected. That is the open question the report is asking regulators to answer.
  • Discover-Tech's account of any of this. The executive summary carries no response from the company.