Spyware attacks proceed through ad displays, this time without requiring you to install a fake application or click on a link. Citizen Lab’s research published on October 15 reports that the ad technology company Discover-Tech provides the infrastructure for these attacks. Researchers have found that this method is distributed through targeted advertising. AdFection gives its name.
Citizen Lab states that it has confirmed the targeting of at least 45 devices belonging to Al Jazeera in 2024 and 2025. The investigation links these incidents to spyware infrastructure linked to Candiru. In addition, the company’s Controlium platform can match devices via advertising IDs and network information. However, the number of targets does not mean successful infection detection on all devices.
On the other hand, an online ad does not only consist of images or video. The ad system can also run code within the browser for measurement and targeting. The investigation examines the misuse of this capability to deliver malicious code to certain individuals. The term zero click means that the attack does not require any additional clicks from the victim.
Citizen Lab shared the findings with advertising vendors and industry organizations. Google, IAB Europe, Beeswax, Vungle and Eskimi then took steps to cut off Discover-Tech’s access to the ecosystem. However, the report does not suggest that these decisions eliminate all similar attacks around the world.
Confiant investigated device profiling hidden in ad traffic
A separate Confiant investigation investigates related activity, starting with an ad that popped into his browser on April 12, 2026. The data window offered by the company covers the period between April 1 and September 10, 2026. The team notes that it encountered a different surveillance purpose than ordinary ad fraud.
In addition, Confiant explains that the code collects device and network characteristics. Operating system, screen size, language and browser features can help differentiate a device from others. The system also tries to separate the real user from the automated browser by using interactions such as movement, swiping and tapping. Researchers attribute this profiling to target selection and hiding from inspection tools.
On the other hand, the review evaluates separately the visible content of the ad and the services it connects with in the background. Therefore, a familiar-looking ad does not by itself indicate which remote infrastructure the code is communicating with. Confiant combines its findings with Citizen Lab’s analysis of the Candiru infrastructure and also discusses Discover-Tech’s connections to other surveillance companies.
Researchers call for improved oversight in the advertising supply chain. The reports reveal technical evidence against specific individuals and devices. On the other hand, it does not provide a general conclusion that the device of every user who sees an ad is infected with spyware.