The Citizen Lab (Organization): news timeline & CVEs

No click required: How the ad industry became a pipeline for mercenary spyware

Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.

The Citizen Lab says Discover-Tech used its Controlium advertising platform, described as AdFection, to win real-time ad auctions, fingerprint devices, and silently deliver exploit code when an ad rendered. Over four months its ads appeared on about 120,768 websites and in 75,373 apps, including impressions on networks associated with NATO and major technology companies; an impression alone is not an infection. Israeli mercenary-spyware vendor Candiru used the path to infect devices at Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi removed Discover-Tech’s access after disclosure.

CSO Onlineupdated Oct 16, 17:20 UTC · 10h agofirst Oct 16, 01:02 UTC · 1d agoMalware in the wild 12 sources1· 1 read

SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape

SecTor 2026 in Toronto drew over 6,500 attendees, up 22%, with talks on agentic AI and civil-society threats.

SecTor, described as Canada's largest cybersecurity conference, closed in Toronto after hosting more than 6,500 verified attendees at the Metro Toronto Convention Centre, a 22% increase. The program included 40 briefings, a day of summits, over 50 sponsored insights, and 36 Arsenal tool demos. Citizen Lab director Ron Deibert said only 4% of threat-intelligence reports focus on civil society despite widespread government targeting of journalists, activists, and human-rights defenders. Advisor Helen Oakley discussed how AI agents change decision-making authority inside enterprises.

Dark ReadingOct 15, 22:10 UTC · 1d agoIndustry3

AdFection: How mercenary spyware invades victims’ devices through targeted advertising

Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware, infecting Al Jazeera devices.

The Citizen Lab and Confiant disclosed AdFection, a campaign in which Israeli company Discover-Tech used targeted advertising to direct devices to Candiru spyware servers without a click. Researchers linked at least 45 Al Jazeera devices to Candiru infections with high confidence, and said the ads also appeared on networks including the U.S. Department of Defense, NATO, and the IAEA. From March through June, Discover-Tech ads were seen on more than 120,000 websites and 70,000 mobile apps. Google and IAB Europe removed the company from approved vendor lists. A related actor, DARK CARTOGRAPHER, is described as linking advertising IDs to phone numbers by exploiting mobile-carrier flaws.

CyberScoopupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 10:00 UTC · 1d agoMalware in the wild 12 sources

The Citizen Lab

Timeline3 articles

Appears with

No click required: How the ad industry became a pipeline for mercenary spyware

SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape

AdFection: How mercenary spyware invades victims’ devices through targeted advertising