Programmatic advertising is built to put a specific message in front of one person among millions. A new report from the University of Toronto’s Citizen Lab shows that the same machinery can deliver malware to a hand-picked target list. And the vendor behind the campaign was not hiding in the shadows: Google and IAB Europe had both listed it for years.
What Citizen Lab found
In a report published October 15, researchers concluded with high confidence that Discover-Tech, an Israeli company, bought targeted ads through ordinary programmatic channels and used them to deliver spyware made by Candiru to at least 45 devices belonging to Al Jazeera staff. The targets did not have to click anything.
Citizen Lab calls the method “AdFection” and describes it as the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
“Once the ad-banner appears on screen, the damage may already be done,” said Nicole Fink of 2fink Consulting.
The delivery mechanism is why the case matters for ad operations. The ads reached out to a server that returned malicious code only to devices on the target list. Scanners and other automated visitors received an empty response of zero bytes, so standard checks found nothing to flag.
The scale is jarring. Between March and June 2026, Discover-Tech bid on 3.77 billion impressions and won 441.95 million. Its ads ran in 75,373 apps and on 120,768 websites, with targets spread across 161 countries and the heaviest bidding in Yemen, Pakistan and Montenegro. Spend over that period was about $109,091.
A listed vendor, not an infiltrator
This is not a story about a rogue actor slipping through a crack. Google had listed Discover-Tech as an ad vendor since 2020. IAB Europe had registered it as vendor 778 in its Transparency and Consent Framework from July 2020. Both lists lean heavily on companies’ own attestations about what they do and how they operate.
Google cut the vendor’s access in early October. Citizen Lab says IAB Europe followed on October 8. Vungle, part of Liftoff, paused access and said, “We have paused all Discover-Tech Ltd. access while we conduct our own review.”
What media buyers should check now
The lesson is not that programmatic buying is broken. It is that trust lists are only as strong as the checks behind them.
- Treat a vendor page as a starting point, not a security clearance.
- Ask DSPs and SSPs what they verify beyond a supplier’s own statements.
- Check whether your partners flag conditional creative responses, such as zero-byte returns to scanners.
- Segment sensitive or high-risk campaigns away from unknown supply paths until a partner can prove its controls.
Citizen Lab’s finding is a research attribution, not a legal ruling, and the Trustworthy Accountability Group still listed the vendor when PPC Land published its report. That gap is exactly the point: a self-attestation regime gives a false sense of clearance until targeted activity is already visible.
Source: PPC Land
