Most people think of an advertisement as something that watches them. In October 2026 Citizen Lab described one that, in its assessment, was used to pick a single device out of billions and hand it to a spyware operator’s servers[S1].
The finding is easy to overstate. Press coverage has used the phrase "hacked phones"; the research itself is narrower, and the Lab’s assessment is that the narrower version is the more useful one.
The pattern in the network logs
Citizen Lab’s Report 195, published on 15 October 2026 and timed with research from Confiant, analyzed network logs supplied by Al Jazeera. It reports a consistent sequence: a device contacts the ad firm, then a "validator" server, then a profiling and infection stage, then a command-and-control server (Figure 1)[S1].
Describe this figure
Five boxes joined by arrows. An advertisement request reaches the ad firm's server; for chosen targets the server returns script, for others an empty reply; the script contacts a validator server; a profiling and infection stage follows; then a command-and-control server.
The ad firm is Discover-Tech, an Israel-based demand-side advertising platform, according to Citizen Lab. Citizen Lab assesses with high confidence that the spyware vendor Candiru was involved[S1]. That is the lab’s research assessment, not a court or government finding. Discover-Tech did not respond within the timeline Citizen Lab gave[S1].
How an ad can be aimed at one person
According to Citizen Lab, customers of a Discover-Tech panel called Controlium could target an individual by mobile advertising identifier, cookie or IP address. When the chosen device requested an ad, the ad server returned JavaScript. Every other device received an empty reply[S1].
That design explains why it was hard to see. Almost all viewers received nothing unusual. Because the script travels inside an ordinary ad response, it can in principle appear on any page or app that displays ads from the exchange.
What Citizen Lab found, and what it did not
Citizen Lab links at least 45 Al Jazeera devices to the activity in 2024 and 2025. It does not say all 45 were infected[S1].
It did not identify a browser or operating-system exploit. It observed the ad script on web pages and in an Android app. The sample it recovered from a device was a Windows library that Citizen Lab says matched Candiru’s 2021 tradecraft, so a mobile infection is not established [S1][S2][S3]. Citizen Lab also stresses that an ad impression alone is not evidence of targeting or infection.
The scale of exposure
Citizen Lab reports about 4 billion advertising bid records between March and June 2026, and ads carrying the script served in 75,373 apps and 120,768 websites[S1].
Those figures describe how widely the mechanism could reach, which is a question about the advertising system, not about phones (Figure 2). The honest reading is that the pipeline was visible at scale and that the targeted count is far smaller.
Describe this figure
Three separate tiles. About 4 billion bid records between March and June 2026. Ads carrying the script served in 75,373 apps and 120,768 websites. At least 45 Al Jazeera devices targeted in 2024 and 2025.
Why advertising is such a convenient channel
Targeting is what an advertising exchange sells. It exists to match a message to a particular device, using the identifiers that apps and sites pass along. A peer-reviewed study by University of Oxford researchers of 24,000 no-charge apps, collected in late 2019 and early 2020, found that 88.73 percent of Android apps and 79.35 percent of iOS apps contained at least one tracking library, and that 86.1 percent of Android apps and 42.7 percent of iOS apps could potentially read the advertising identifier[S6]. The data are dated and measure capability, not misuse.
Regulators have shown the same ecosystem can leak. In January 2025 the US Federal Trade Commission finalized orders barring two data brokers from selling sensitive location data gathered through mobile advertising[S7]. The Lab’s reading is that a system built so one device can be chosen among billions is neutral about who is choosing. AdFection is what the report describes when the chooser is a spyware operator.
Who responded
According to Citizen Lab, Google ended Discover-Tech’s exchange access and added browser warnings, Google and IAB Europe removed it from their registries, and several other ad platforms blocked or paused it[S1]. Citizen Lab also links Discover-Tech to two other firms in the advertising-intelligence field and notes a past shareholder connection to the corporate network around Intellexa, another spyware vendor. It does not attribute the Al Jazeera attacks to Intellexa[S1]. Neither of those two firms responded to the lab[S1]. No regulator has made a finding, and Citizen Lab calls on regulators to investigate.
What the numbers do not say
Three cautions apply to every figure in the report. Bid records count requests to advertisers, and one phone generates many. Apps and websites that served the script were places the code could reach, not places where a phone was compromised. And the 45 devices are those Citizen Lab links to the activity, in logs from one organization, which cannot be extrapolated to other organizations or to the public. Citizen Lab itself describes the devices as targeted and does not say all were infected[S1]. Press accounts that list well-known organizations as affected concern ad impressions, not infections, and the Lab does not repeat them.
Not entirely new
Advertising as a delivery route has been described before. Amnesty-led reporting on the "Intellexa Leaks" in December 2025 described an ad-based method, called Aladdin in the leaked material, for pushing a crafted ad to a target identified by public IP address and other identifiers; the vendor denies the characterization[S5]. Google’s threat intelligence group reported that it worked with partners to shut down ad accounts used for malicious ads, and that such ads had emerged since early 2025[S4].
What a phone keeps after an ad
An advertisement is displayed and gone. If no exploit runs on the phone, the durable record is thin: the page or app that displayed the ad, any browser history entry for that page, the network sessions that followed, and the state of the advertising-identifier setting. Some of these are controlled by the owner; browser history can be cleared and the identifier can be reset. Network records outside the phone, such as the logs Al Jazeera supplied, are often the stronger source, which is why Citizen Lab could reconstruct the sequence at all[S1].
Our assessment
The Lab reads the evidence this way.
First, the contribution of AdFection is the pipeline, not a phone exploit. It documents, from real network logs, how targeting data in the advertising system can feed a delivery system.
Second, for phones the evidence is most likely to be network metadata. Where no exploit runs on the phone, little may remain on it beyond a page or app visit and the connections that followed.
Third, the result is bounded. Citizen Lab did not find a mobile exploit[S1], so the report cannot be used to say that phones were compromised through this route. It can be used to say that a route to a chosen phone existed, and that its first stages were visible in network logs.
Fourth, the attribution is Citizen Lab’s. Citizen Lab does not say Discover-Tech knew the end use[S1], and the Lab does not say so either.
What the Lab is watching
- Whether Discover-Tech or the two linked firms respond or change their conduct after 15 October.
- Any regulatory action in the advertising ecosystem.
- A mobile sample, which would turn a pipeline finding into a phone finding.
- Whether the advertising-exchange registries tighten how buyers are verified.
What this means for examiners
Citizen Lab’s own recommendations are about hygiene: block ads and trackers at the network gateway, turn off advertising identifiers on managed devices, use an ad-blocking DNS service, and watch for ad-triggered requests to known bad destinations[S1]. For an examiner the corollary is to preserve network evidence, not only the phone.
Our approach
How SectraTEK approaches this
An ad-delivered event with no exploit on the phone may leave only network metadata: which destinations were contacted, when, how regularly and how much. SectraTEK examines a preserved network capture for exactly that, who, when, how regularly and how much, reading metadata and never decrypting content, and it highlights a regular check-in rhythm for review first. Browser records show which pages were visited, background network activity shows which apps and services connected, and the evidence may record the advertising-identifier privacy setting. An examination makes no outside contact while it runs.
The limits are real. Zero-click delivery often leaves little on the phone itself, a result with no findings means no known indicators were found in the evidence provided, and the AdFection case itself did not establish a mobile infection. SectraTEK does not claim to detect this operation.
Facts about third parties in this article are attributed to the publisher named and were last checked on 21 October 2026. Corrections carry their date.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Citizen Lab (Report 195) Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware | citizenlab.ca | ||
| [S2] | The Record Spyware and advertising: Citizen Lab report | therecord.media | ||
| [S3] | SecurityWeek Israeli ad firm doubled as Candiru's zero-click spyware delivery channel | https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/ | ||
| [S4] | Google Threat Intelligence Group Intellexa: zero-day exploits continue | https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue | ||
| [S5] | The Hacker News Intellexa Leaks reveal zero-days and ad-based delivery | https://thehackernews.com/2025/12/intellexa-leaks-reveal-zero-days-and.html | ||
| [S6] | Proceedings on Privacy Enhancing Technologies (Kollnig and colleagues, University of Oxford) Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps | petsymposium.org | ||
| [S7] | US Federal Trade Commission FTC finalizes order prohibiting Gravy Analytics and Venntel from selling sensitive location data | www.ftc.gov |
The sources were last read on . If a fact here changes, the correction carries its date.