Citizen Lab: targeted ads from a Google-listed vendor delivered Candiru spyware

Citizen Lab, a research group at the University of Toronto, reported on 15 October 2026 that targeted online ads were used to infect devices at the news network Al Jazeera with spyware from Candiru, an Israeli-founded spyware vendor. The ads were bought by Discover-Tech, an Israeli company that presented itself as a demand-side platform (DSP) and had been listed by Google and by industry body IAB Europe as a certified or approved ad vendor since 2020. Citizen Lab calls the technique "AdFection" and says it is the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. Google removed Discover-Tech from its vendor lists and IAB Europe suspended it from its Global Vendor List in early October 2026, according to the report.

The full report, Exposing AdFection (Citizen Lab Report 195), is by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, and was published alongside a parallel investigation by ad-security firm Confiant. This article sticks to what the report states, because most of what matters for advertisers and publishers here is about how the ordinary ad supply chain was used, not about the spyware itself.

What Citizen Lab found at Al Jazeera

According to the report, at least 45 devices within Al Jazeera were targeted in a series of zero-click attacks in 2024 and 2025. Citizen Lab links the attacks "with high confidence" to Candiru spyware delivered through Discover-Tech ads. Candiru now operates under the name Integrity Labs, and was added to the US Commerce Department's Entity List in November 2021.

The evidence came from network logs that Al Jazeera shared with the researchers. Infected devices first contacted Discover-Tech infrastructure, which indicates an ad impression. They then contacted a Candiru "validator" server, which checks a device before it is profiled further, and finally a Candiru command-and-control server. Al Jazeera also isolated a Windows file from a compromised device, which Citizen Lab analysed and judged to be a newer version of the Candiru attack chain it first documented in 2021. Al Jazeera consented to being named.

Zero-click means the user did not need to tap anything. The report states that displaying the targeted ad was enough to start the chain.

How the attack ran inside a normal ad auction

The report starts with a plain description of real-time bidding (RTB). When an app or website has an ad slot, code from a supply-side platform (SSP) sends information about the user and device to an ad exchange to request bids. That information can include device identifiers, IP address and location. A DSP decides whether to bid, and the winning ad is pushed to the device. An ad can also carry code, the same kind of tags and pixels advertisers use every day to count impressions and clicks.

Discover-Tech used both features. Many of its ads contained a script tag that called back to its own server, which the company called a "NOAS" or "getAd" server, and passed along the user's cookie ID or mobile advertising ID. The server then decided, apparently based on the IP address and those IDs, whether the device was a target. A target received JavaScript. Everyone else received a zero-byte, empty response.

That design matters for anyone who relies on ad verification. Because the malicious code was only served to selected devices, Discover-Tech did not have to share it, or even a pointer to it, with the companies that served and displayed the ads. Eskimi, one of the DSPs Discover-Tech used, told Citizen Lab that the advertiser's tags were built to evade automated scanning and loaded different code depending on the viewer, which is how they passed third-party verification.

The report also describes Controlium, a Discover-Tech platform whose front-end code was publicly visible. It let customers pick targets by iOS or Android advertising ID, cookie ID or IP address, and choose a delivery route: Beeswax, Eskimi or Discover-Tech's own MyDSP, which in turn could bid through Google's or Yandex's exchange.

The bidding data in numbers

Citizen Lab found publicly readable databases on a Discover-Tech domain holding MyDSP bidding records for March to June 2026. These records cover MyDSP only, not Beeswax or Eskimi. The figures below are taken from Section 5 of the report.

A few details in that data are worth spelling out. The database listed only three advertisers, and most of them appear attributable to Discover-Tech itself or to entities the report links to it. Revenue fields were zero except for a three-day period in June, and conversion fields were always zero, which the report calls highly unusual for an ad vendor. Citizen Lab concludes there is no good evidence that MyDSP was earning money by selling ads in the normal way.

One advertiser name in the data was AliExpress, attached to generic "SALE" creatives. The report says it has no evidence of a business relationship between Discover-Tech and AliExpress, and that the ads were likely not bought on AliExpress's behalf. Separately, the report notes that some Controlium ads carried branding from apparently unwitting companies, including Amazon and AliExpress.

The script-tag ads appeared in a wide range of mainstream apps and websites, from news and weather sites to games, messaging and email apps. Nothing in the report suggests those publishers knew what was being served through their ad slots.

How a vendor stayed on "certified" lists for six years

The section most relevant to the ad industry is about vendor registries. According to Table 9 of the report:

• IAB Europe listed Discover-Tech on the Global Vendor List of its Transparency and Consent Framework (TCF), vendor ID 778, from 2 July 2020 until 8 October 2026.
• Google listed it among its Ad Manager Certified External Vendors and its EU Ad Technology Providers for Ad Manager, AdSense, AdMob and Display & Video 360, from 2020 until early October 2026.
• Google's list of ads personalization providers named Discover-Tech and attributed the domains mtrtb.com and mydsp.io to it.

The report argues that these lists appear to rest largely on vendors' own statements, and that information about Discover-Tech's links to people in the spyware industry was available in corporate records. That is Citizen Lab's assessment. It also notes that a GVL listing has become close to a requirement for an ad vendor to work in Europe, and that Discover-Tech's tracking code used the TCF to process consent signals for European users. As of October 2026, the report says, Discover-Tech still held a listing in the Trustworthy Accountability Group (TAG) registry.

The report is careful on one point that advertisers should note. It says the mainstream ad vendors named in it are distinct from spyware or surveillance vendors, because they were not necessarily aware their infrastructure was being misused.

What Google, IAB Europe and the vendors did

The report records these actions after disclosure:

• Google, which collaborated in the investigation, removed Discover-Tech from its vendor registries and terminated its access to Google's ad exchange platforms in the first week of October 2026. In its statement to Citizen Lab, Google said this meant "blocking them from bidding or serving ads across our ecosystem", and that it had deployed Safe Browsing protections to warn users who may encounter known actor-controlled domains.
• IAB Europe suspended Discover-Tech from the Global Vendor List on 8 October 2026. It did not respond within Citizen Lab's deadline but sent a response on 15 October.
• Beeswax (FreeWheel, owned by Comcast) removed Discover-Tech from its buying platform.
• Vungle (Liftoff) paused Discover-Tech's access while it runs its own review.
• Eskimi blocked Discover-Tech's accounts and domains. It said Discover-Tech had been a self-service advertiser since 2022 with only a few hundred dollars of spend on its platform, and that its last campaign there was stopped on 6 August 2026.

Discover-Tech, Candiru, Xandr (Microsoft Advertising), Sunteng and several other companies did not respond to Citizen Lab within the deadline.

What the report did not say

Several limits in the report are easy to lose in a headline:

• An ad impression is not an infection. The report states directly that a Discover-Tech impression does not in itself confirm targeting or spyware infection.
• The bidding data covers one platform, MyDSP, over four months. It does not include Beeswax or Eskimi activity, so the full scale is unknown.
• Country figures are based on IP geolocation, which the report says can be inaccurate because of VPNs, satellite providers and similar factors.
• The report lists Thailand among 24 countries where it found Discover-Tech impressions inside government-operated networks. It gives no Thai figures, and the same caveat applies: an impression there does not in itself confirm targeting or infection.
• A separate actor, which Citizen Lab calls DARK CARTOGRAPHER, used Discover-Tech infrastructure to try to link advertising IDs to phone numbers through mobile carrier weaknesses in more than 30 countries. Details are held back for a later report while disclosure to carriers continues.

What this means for Thai marketers

This section is RA's analysis, not a finding of the report.

For advertisers, the direct risk from this case is small, but the lesson about the supply chain is not. Discover-Tech used real retail brand names on its creatives without, as far as the report shows, any relationship with those brands. Brands that are heavily searched or heavily advertised can check whether their names or creatives show up in places they did not buy. Advertisers buying display, in-app or programmatic inventory, including through Google Ads campaigns that reach display and app placements, can also ask partners which intermediaries sit between their budget and the final impression. The report shows that a "certified" label alone did not answer that question.

Publishers and app owners in Thailand sell the ad slots this kind of attack depends on. The report found the script-tag ads across more than 120,000 websites and 75,000 apps, and nothing suggests those owners did anything wrong. Still, the case is a reason to review which demand partners and third-party tags are allowed to run on a site or in an app, and which vendors a consent banner lists. A periodic tag and consent audit, often done alongside a GA4 and tracking setup review, is the practical place for that check.

For organisations whose staff could be of interest to state-level attackers, such as media, government suppliers or critical infrastructure, Citizen Lab's own recommendation is to block ads and tracking on work devices and at the network gateway, and to opt company-issued devices out of ad targeting. That advice comes from the report and is aimed at security teams rather than marketers.

Finally, the report calls on regulators to investigate Discover-Tech and Candiru, and argues for mandatory audits and know-your-customer checks for vendors on industry registries. Whether any regulator acts is not known yet. Teams that rely on vendor lists for consent or supply decisions should watch for changes to how Google and IAB Europe vet listed companies.

Frequently asked questions

Were Google Ads advertisers affected by this?

The report does not say that any ordinary advertiser's campaigns were compromised. What it shows is that Discover-Tech bid through Google Ad Manager's exchange, which made up 24.74% of MyDSP's bids, alongside Yandex at 67.4%, and that Google cut off its access in early October 2026.

What is AdFection?

AdFection is Citizen Lab's name for delivering zero-click spyware through targeted ads. An ad wins an auction, loads a script that sends the device's advertising ID or cookie ID to Discover-Tech's server, and only a chosen target receives malicious code, so simply displaying the ad can start an infection.

Did the report find targeting in Thailand?

No targeting in Thailand is reported. Thailand appears on the report's list of 24 countries where Discover-Tech ad impressions were seen in government-operated networks, and the report states that an impression does not confirm targeting or infection.

Why did ad verification not catch it?

Because the harmful code was never in the ad that verification tools scanned. Discover-Tech's server returned JavaScript only to selected devices and an empty response to everyone else, and Eskimi told Citizen Lab this is how the tags passed third-party verification.

Do I need to change anything in my ad accounts?

The report sets no requirement for advertisers. It recommends that ad vendors vet and audit partners more strictly and that organisations at risk block ads on work devices; for most advertisers the sensible step is reviewing supply partners, tags and consent vendor lists.

The Discover-Tech case shows that a vendor can sit on major industry lists for years while using ordinary ad tools for something else entirely. If you want a second look at which partners, tags and placements your campaigns depend on, Relevant Audience can help you map it.