What Citizen Lab found
On 15 October 2026, Citizen Lab published "Exposing AdFection," which it describes as documenting how Israeli intermediary Discover-Tech turned targeted advertising into a delivery pipeline for Candiru's mercenary spyware. According to the report, at least 45 devices within Al Jazeera were targeted in 2024 and 2025. The victim did not need to click anything. Rendering the ad was enough.
The mechanics matter more than the headline. Discover-Tech bought placements through mainstream ad networks and exchanges. Script embedded in the ads contacted its servers, which checked signals such as IP address and advertising identifiers. Devices that matched a target profile received additional code, and everyone else received nothing (BleepingComputer). Selective delivery is why a campaign that touched an enormous audience stayed invisible for so long.
The scale of the buying is the part regulators should dwell on. Citizen Lab reports that between March and June 2026 the operation's bidding platform bid on about 3.77 billion impressions and won roughly 442 million, an 11.7% win rate. Those are impressions, not infections. But they show the pipe was wide, cheap and fully integrated into commercial infrastructure.
After the findings were shared, Google terminated Discover-Tech's exchange access, IAB Europe removed it from its registry, Beeswax removed it from its buying platform and Eskimi blocked its accounts and domains. Vungle (Liftoff) paused access pending review, a weaker step than the others, per Citizen Lab. Al Jazeera reports that Google and IAB Europe had listed the firm as a certified or approved vendor (Al Jazeera).
The strongest case for tougher rules
The case for aggressive intervention is serious. Candiru was blacklisted by the US government in 2021, yet its technology, now operating under a new brand according to press reports, still reached journalists. Voluntary vetting by ad platforms failed, and it failed for years. Cleanup by five companies came only after an outside laboratory did the investigative work. If self-regulation were adequate, a certified vendor would not have been able to monetize this pipeline. Advocates therefore argue for liability on exchanges, mandatory buyer verification and even bans on programmatic targeting.
That argument is right about the diagnosis. It overreaches on the remedy.
Why blunt remedies would miss
Banning or throttling programmatic advertising would punish the open web's main funding model for news publishers, including the independent outlets that spyware targets. It also would not stop the underlying capability. Any channel that delivers code to a chosen device, whether an ad slot, a message or a link, can be abused by a determined vendor. Regulating one channel at a time is a game of whack-a-mole.
The more proportionate approach has three parts.
- Know-your-buyer duties on exchanges and demand-side platforms. A firm buying at a scale of billions of bids should be verified as a real advertiser. Certification registries should be audited and revocable, and the registries involved here plainly did not catch this one.
- Data minimization in the bid stream. Each auction broadcasts device identifiers and IP data to every bidder. That leakage is what lets an attacker pick out one journalist among millions. Analyst Stephen O'Shaughnessy told Al Jazeera that regulators need to limit personal data shared with bidders in every auction. Privacy law and security policy point the same way here.
- Targeted pressure on the vendor layer. Citizen Lab calls on regulators to investigate whether Discover-Tech and Candiru violated applicable laws. Export controls, entity listings and procurement bans aimed at the spyware vendors and their facilitators are narrower and more effective than platform-wide mandates.
The diplomatic layer is too soft
The main multilateral effort, the Pall Mall Process, produced a Code of Practice for States launched in Paris on 3 to 4 April 2025 by the UK and France. The GOV.UK paper describes it as voluntary and non-binding, built on four pillars: accountability, precision, oversight and transparency (GOV.UK). Freedom House welcomed it but noted that it is nonbinding, that its human rights language is hedged and that it does not address transnational repression (Freedom House). A state-focused code also does not obviously reach a private ad-tech intermediary sitting between the vendor and the exchange. The forthcoming industry-facing work should name that layer explicitly.
What to watch
Three things will show whether AdFection changes anything. First, whether the five companies publish what they changed in vetting, not just what they removed. Second, whether any regulator opens the investigation Citizen Lab requested. Third, whether other exchanges audit their own logs for the same signatures. Citizen Lab itself recommends that defenders block ads and tracking on devices and gateways, which is sensible hygiene for newsrooms today but not a substitute for fixing the supply chain.
The lesson is not that advertising is irredeemable. It is that an auction open to anyone who can pass a thin certification will be used by whoever pays best, including surveillance vendors. Verification, data minimization and vendor-targeted sanctions preserve the open, ad-funded web while closing the specific hole that AdFection exploited.