The Citizen Lab published research on 15 October describing AdFection, which it calls the first publicly confirmed case of zero-click mercenary spyware delivered through targeted advertising. Israeli adtech firm Discover-Tech presented itself as a legitimate advertising company while operating the Controlium/MyDSP platform, which let mercenary partners de-anonymise, fingerprint and infect devices the moment an advertisement rendered — no click or download required. Analysing nearly four billion bidding records from March to June 2026, Citizen Lab found Discover-Tech's MyDSP bid on about 3.77 billion impressions and won roughly 442 million, appearing on more than 120,000 websites and 70,000-plus mobile apps. At least 45 devices at Al Jazeera were targeted in 2024–25 in attacks the researchers link with high confidence to Candiru spyware (now Integrity Labs) delivered through the ads, and impressions reached networks used by government, defence and critical-infrastructure organisations including the Pentagon, NATO, the European Commission, the International Criminal Court and the IAEA. Australian reporting by iTnews says the ads reached ANSTO, the Australian Synchrotron and other government and critical-infrastructure networks. Google and IAB Europe have suspended Discover-Tech; Citizen Lab called for regulators to investigate the company and Candiru.

• Source article