Citizen Lab finds spyware delivered through ads

The University of Toronto’s Citizen Lab said Oct. 15 that spyware from the Israeli firm Candiru infected devices at Al Jazeera through targeted online ads that required no click from the user, which it called the first public confirmation of such an attack.

In its report, titled Exposing AdFection and published as Citizen Lab Report 195, the lab said at least 45 Al Jazeera devices were targeted in 2024 and 2025. It linked those attacks to Candiru, which now operates as Integrity Labs, with high confidence.

The researchers said the ads were bought by Discover-Tech, an Israeli advertising company. When a person sees one of the ads, the person’s IP address is passed to Discover-Tech. If that person is later selected as a target, malicious code is delivered to the browser or app. “The simple display of a targeted ad is enough for infection,” the report said.

The scale of the ad buying is much larger than the Al Jazeera infections. Citizen Lab said ads carrying the attackers’ script tags appeared in 120,768 websites and 75,373 mobile apps, and that bids carrying the script targeted devices in 161 countries. One server counted 3,637,213 eligible users from January to June 2026. The report does not say how many of those people were infected.

The Canadian connection goes beyond the lab’s home base in Toronto. The report says the ads were seen while browsing CBC and Yahoo websites, and lists cbc.ca among the sites that carried them. Neither the report nor BetaKit’s coverage says that any CBC reader was infected, and the report does not suggest CBC was involved in the scheme.

Citizen Lab said it sent requests for comment to 13 companies and notified ad vendors. Google removed Discover-Tech from its registry and ended its access to Google’s ad exchange, the report said. Beeswax removed it from its ad buying platform, and IAB Europe removed it from its registry. Vungle, which operates as Liftoff, paused Discover-Tech’s access pending review, and Eskimi blocked its accounts and domains. Other vendors, including Bindecy and Intelos, did not respond within the lab’s timeline.

Candiru and Discover-Tech did not appear in the coverage reviewed for this story with any public response.

Wolfie Christl, a senior Citizen Lab researcher, told WIRED that the risk of infection through ads is a “nightmare scenario,” according to BetaKit. The report calls on regulators to investigate whether Discover-Tech and Candiru broke applicable laws, and BetaKit reported that the researchers want cybersecurity agencies and regulators in the United States, Canada and Europe to find ways to detect and block such attacks.

BetaKit also reported that a separate actor, which Citizen Lab calls Dark Cartographer, has used Discover-Tech’s infrastructure to exploit vulnerabilities across several mobile carriers. A forthcoming Citizen Lab report is to cover that activity.

For Canadian readers, the finding lands as the country builds up its cyber defences. Google.org this week backed a $3.5-million Cyber Clinics Canada network, banks and telecoms launched the CSAFE fraud-sharing platform, and a Canadian was arrested by the FBI in the ShinyHunters hacking probe. None of those efforts address ad-delivered spyware, which the lab said works without any action from the target.

Citizen Lab has long documented spyware used against journalists and civil society groups. The new report shifts attention from the spyware itself to the advertising supply chain that can carry it.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.

Sources: Citizen Lab, Exposing AdFection (Oct. 15, 2026); via BetaKit (Oct. 15, 2026), which cites WIRED.