On 15 October 2026 the Citizen Lab at the University of Toronto published a report on what it calls AdFection: spyware delivered through online advertising, with no click required. In its own words, it is "the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising".
The detail that matters for most businesses isn't the spyware. It's the route: an ordinary ad, bought through the normal advertising system, carried the code.
What Citizen Lab found
According to the report, the ads were bought by Discover-Tech, an Israeli company that, Citizen Lab says, "presents itself as a legitimate advertising company" but operates as a facilitator for spyware vendors. Citizen Lab links its activity to Candiru, which it notes has been rebranded as "Integrity Labs". These attributions are Citizen Lab's, and the full evidence is in its report.
Citizen Lab describes a platform called Controlium that "enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack." Targeting used ordinary advertising identifiers, including mobile advertising IDs for Android and Apple devices and IP addresses.
The mechanism is simple to describe. When a website or app shows one of these ads, the ad requests JavaScript from a server embedded in it. Citizen Lab is clear that this usually came to nothing: "In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed." For the people who were selected, the code ran without them doing anything.
The scale of the delivery channel
Citizen Lab reports that ads with attacker script tags "were shown to users of 75,373 different Android and iOS apps and to visitors of 120,768 different websites in mobile and desktop browsers." Those are places the ads appeared, not a count of people attacked. The report also says where its view ran out: on one server, for example, the researchers "were unable to obtain any of the JavaScript code" it served.
The ads ran through mainstream advertising networks, which is how they reached that many apps and sites. Citizen Lab reports that after it disclosed its findings, "Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took action to disconnect Discover-Tech's access to the digital advertising ecosystem." Its broader conclusion is about the system rather than any one network: the abuse illustrates "structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report."
Why an ordinary business should care
If you run ads, carry ads on your website, or ship an app with an advertising SDK, you are already letting other companies run code in front of your users. Citizen Lab spells this out: "ads themselves may contain code from the advertiser, DSP, and other parties, and run it in the app or browser while the ad is shown to the user".
Most of that code is mundane: measurement, tracking, frequency caps. The point of AdFection is that the same channel can carry anything, and the business whose app or website displays the ad usually can't see what ran.
That makes it a supply-chain question, and a few questions are worth putting to whoever builds or runs your website and apps:
- Who can put JavaScript on your users' screens? Ask for a list: ad SDKs in your app, tags and pixels on your site, and every network behind them.
- Who added each one, and why? A tag nobody owns is a tag nobody will remove.
- Do you need it at all? Every third party you remove is one fewer route in.
- How fast can you switch one off? If a network turns out to be a problem, the answer should be hours, not a release cycle.
None of these require an expert to ask. They do require someone on your side to be able to answer.
Source: Citizen Lab, "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware" (published 15 October 2026, read 16 October 2026).