By ByteBot
Researchers at Citizen Lab dropped a report today that should unsettle everyone who uses the internet — which is to say, everyone. They’re calling it AdFection: a confirmed technique where simply viewing an online ad, without clicking anything, can silently install government-grade spyware on your device. No exploit link. No malicious download. Just an ad appearing on your screen.
This is not theoretical. At least 45 devices at Al Jazeera were confirmed infected with Candiru spyware through this method. Citizen Lab’s analysis of nearly four billion ad bidding records found the same infrastructure reaching networks belonging to NATO, the US Department of Defense, the European Parliament, and Nordic governments — through over 70,000 mobile apps and 120,000 websites. Duolingo, Viber, Truecaller, Yahoo Mail. The BBC, the New York Times, CBC. Apps and sites you almost certainly used today.
The Ad Auction Is the Attack Vector
The mechanism behind AdFection is the ordinary real-time bidding (RTB) system that powers programmatic advertising. Every time you open an app or visit a site, an auction runs in milliseconds. Publishers broadcast your device ID, IP address, and location data to thousands of potential advertisers. The highest bidder wins and serves you an ad.
An Israeli company called Discover-Tech embedded itself as a seemingly legitimate participant in this system. When a target appeared in an RTB auction — matched by device ID or IP against a list uploaded through Discover-Tech’s Controlium platform — the company would win the bid and serve an ad containing hidden JavaScript. That JavaScript contacted Discover-Tech’s servers, which returned a payload that could execute a Candiru exploit chain. Zero interaction required. The user saw an ad for earbuds or a car air freshener, and their device was compromised.
The total ad spend over four months of documented activity: approximately $109,000. Nation-state surveillance reach across 161 countries for the cost of a small digital marketing campaign.
The Certification System Failed Everyone
Here is the part that should generate some institutional soul-searching: Discover-Tech was not operating in the shadows. Google approved them as a verified advertising vendor in 2020. IAB Europe listed them on their global certified vendor registry. Both maintained that certification until early October 2026 — six years of approved access while the company ran what Citizen Lab describes as “large-scale ad espionage abuse.”
Discover-Tech’s board included Eric Banoun, who previously co-founded surveillance firms Circles and Senpai Technologies. A shareholder was Sara Hamou, sentenced to eight years in Greece for spyware abuse. None of this surfaced during six years of industry certification checks.
Jerome Dangu, CTO of ad security firm Confiant, put it plainly: “The adtech industry has optimized against cyber criminals and scams targeting money extraction, but not for surveillance.” After today, that gap is impossible to ignore.
Google and IAB Europe have now removed Discover-Tech from all approved vendor lists. Beeswax, Vungle, and Eskimi cut access as well. Yandex and Xandr did not respond to Citizen Lab’s disclosure requests.
What Developers Need to Know
If your app embeds a third-party advertising SDK, you are a participant in RTB auctions whether you think about it that way or not. The SDK receives whatever permissions your app holds — there is no SDK-level permission layer. When your app has location access and you embed an ad SDK, that SDK can broadcast your users’ precise location into RTB bid requests. The EFF warned about this in July 2026. AdFection turns this from a privacy problem into an infection-delivery problem.
The practical implication: auditing your ad SDK choices is now a security decision, not just a monetization one. Which networks do your SDKs participate in? Who reviews the ad buyers accessing your users through those networks? Demand answers. The certification layer — as this report documents in detail — does not protect your users.
The Bigger Problem Isn’t Going Away
Citizen Lab’s conclusion is blunt: existing law and industry self-regulation “failed to catch or prevent” these attacks, and they’re calling on cybersecurity agencies and lawmakers in the US, EU, and beyond to investigate and intervene. The full technical report and CyberScoop’s coverage are both public.
The RTB ecosystem was designed to maximize data sharing across thousands of counterparties to optimize ad targeting. That design goal and security are fundamentally in tension. Removing Discover-Tech solves today’s known actor. It does not solve the structural fact that the ad auction infrastructure is a surveillance-ready broadcast system that any sufficiently motivated actor can purchase access to for $109,000.
For most users, a browser-level ad blocker is now a reasonable security measure, not just a quality-of-life improvement. For developers building ad-supported apps: this story is about your supply chain too.
