Glossary term
Malvertising
Malvertising is the use of online adverts to deliver malicious activity, such as a forced redirect to a harmful site or a malware payload.
Read more
Significant cyber incident
AdFection: spyware delivered through targeted online ads
Also known as AdFection
AdFection is the Citizen Lab's name for attacks that used targeted online ads to install mercenary spyware with no click.
In short
AdFection is the Citizen Lab's name for attacks that used targeted online ads to install mercenary spyware with no click. Its report of 15 October 2026 says at least 45 devices at an international news network were targeted in 2024 and 2025. It attributes the spyware to Candiru with high confidence.
What happened
On 15 October 2026 the Citizen Lab, a research lab at the University of Toronto, published a report it calls Exposing AdFection. It says this is the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
In 2024 and 2025 an international news network was hit by a series of these attacks. At least 45 of its devices were targeted. The network isolated a Windows DLL from one compromised device. The Citizen Lab says its command servers match a server fingerprint from its research and its functions broadly overlap with the Candiru chain it described in 2021. That is why it ties the attacks to the Candiru spyware profile.
The ads were bought through Discover-Tech. The Citizen Lab says the company presents itself as an ad business, but works as a one-stop platform for spyware firms to infect targets through ads.
Timeline
- 4 November 2021
The US Commerce Department adds Candiru to the Entity List for supplying spyware to foreign governments.
- 2024 and 2025
At least 45 devices at an international news network are targeted in zero-click attacks through ads.
- March to June 2026
Discover-Tech ads appear in over 70,000 mobile apps and over 120,000 websites, according to bidding records the Citizen Lab studied.
- Early October 2026
An ad exchange ends Discover-Tech's access and IAB Europe removes it from its vendor list.
- 15 October 2026
The Citizen Lab publishes Exposing AdFection and attributes the spyware to Candiru with high confidence.
How the attack worked
The method is a targeted form of malvertising. In ATT&CK terms it is a drive-by compromise (T1189), since MITRE lists paid ads as one way to deliver exploit code to a browser.
- A customer picks one person in the Controlium platform by mobile advertising ID, browser cookie or IP address.
- An ordinary looking ad is shown on that person’s device. The ad itself does not carry the exploit, which helps hide it from ad platforms.
- The device’s ad identifier and IP address go to Discover-Tech servers, where the device is checked and profiled.
- Malicious JavaScript then runs in the browser or app. It can load more code, such as a browser exploit.
- The spyware contacts its command and control server. On Windows it stays in place through a COM hijack.
ATT&CK techniques
Who says who was behind it
Attributed by the Citizen Lab, 15 October 2026: it found with high confidence that devices at an international media network were targeted and infected with Candiru's spyware. It names Discover-Tech, an Israeli company, as the ad platform used for delivery.
No government body has attributed these attacks in the sources we opened. In November 2021 the US Commerce Department listed Candiru for developing and supplying spyware to foreign governments.
Malware and vulnerabilities used
Impact
The confirmed impact is at least 45 targeted devices at one international news network. The wider reach is larger but unconfirmed. Between March and June 2026, Discover-Tech ads appeared in over 70,000 mobile apps and over 120,000 websites. The Citizen Lab found ad impressions in networks of defence ministries, armed forces and national cyber agencies in many countries. It warns that an impression alone does not confirm targeting or infection, and calls for urgent checks of those networks.
Government and regulator response
- Ad industry: in early October 2026 an ad exchange that worked with the researchers ended Discover-Tech’s access, and IAB Europe removed the company from its vendor list.
- Companies asked: the Citizen Lab sent requests for comment to 13 companies before publication. Discover-Tech and Candiru had not answered by its deadline.
- Researchers: the report asks regulators to look into Discover-Tech and Candiru, and gives defenders a list of steps against ad-borne attacks.
- Earlier action: the US Commerce Department had put Candiru on its Entity List on 4 November 2021.
Lessons
-
An ad can be the attack
No click was needed. Showing a targeted ad was enough, so training people to avoid links does not cover this route.
-
Ad IDs are tracking IDs
The attackers picked targets by mobile advertising ID. On work phones that ID has no business value and can be turned off.
-
The network edge matters
The Citizen Lab found ad impressions in defence and government networks. Blocking ads at the gateway removes the delivery route for everyone behind it.
-
Old names come back
The sample from these attacks broadly overlaps with a chain first described in 2021. A spyware maker on the US Entity List kept working and has since rebranded, the Citizen Lab says.
What to check in your own organization
-
Gateway ad blocking
Check whether ads are blocked at your gateway and on work issued and edge devices.
-
Advertising IDs
Check that device management turns off unique advertising IDs on managed phones.
-
Browser choice
Check that staff browsers block trackers and ads and support Global Privacy Control.
-
Ad traffic logs
Check whether you log and review traffic linked to ad impressions for odd requests.
-
High risk staff
List the people most likely to be targeted, such as journalists, executives and officials, and give them a place to report odd device behaviour.
Questions
What is AdFection?
The Citizen Lab's name for attacks that used targeted online ads to install mercenary spyware without a click, described in its report of 15 October 2026.
Which spyware was used?
The Citizen Lab attributes it with high confidence to Candiru, an Israeli spyware maker on the US Entity List since November 2021.
Did the victim have to click the ad?
No. The Citizen Lab says the simple display of a targeted ad was enough for infection.
Was every device that saw an ad infected?
No. The Citizen Lab says only devices selected for hacking were sent the malicious code, and that an ad impression alone does not confirm targeting or infection. It adds that the impressions would at least have led to profiling.
How can an organisation reduce the risk?
Block ads at the gateway and on work devices, turn off advertising IDs on managed phones and use browsers with anti-tracking and ad blocking.
In our research
- Malvertising Glossary term
- Mercenary spyware Glossary term
Sources
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (15 October 2026) The Citizen Lab
- Exposing AdFection Executive Summary (15 October 2026) The Citizen Lab
- Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus (15 July 2021) The Citizen Lab
- Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities (4 November 2021) US Bureau of Industry and Security
- Drive-by Compromise, T1189 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 54 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 106 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.