AdFection is the name Citizen Lab gave to a technique where the ad company Discover-Tech used its Controlium platform to de-anonymize and fingerprint devices through real-time ad bidding, then serve chosen targets a malicious ad that silently infected the device with Candiru mercenary spyware the moment the ad rendered — no click, no download.

Am I at risk from AdFection-style ad spyware?

The confirmed targets were journalists and staff at Al Jazeera — mercenary spyware is sold to governments for targeted surveillance, not mass infection. But the delivery mechanism (compromised ad supply chains) touches everyone: Discover-Tech ads appeared on ~200,000 websites and apps. Keeping devices updated, enabling Lockdown Mode (iOS) or Advanced Protection (Android), and limiting ad tracking sharply reduce your exposure.

What happened to Discover-Tech after the Citizen Lab report?

Google removed Discover-Tech from its ad platforms and vendor lists, IAB Europe removed it from its approved vendor list, and ad platforms including Beeswax, Vungle, and Eskimi cut off or suspended the firm in early October 2026. Citizen Lab also flagged a separate actor, DARK CARTOGRAPHER, using the same infrastructure — detailed in a forthcoming report.

ADFECTION — ZERO-CLICK SPYWARE VIA ADS — CONFIRMED OCT 15, 2026

Spyware is now delivered through ads you never click

On October 15, 2026, the University of Toronto's Citizen Lab published the first public technical proof that mercenary spyware reached real devices through targeted online ads. The ad firm Discover-Tech — a Google-certified vendor — used its Controlium platform to fingerprint devices in ad auctions and serve chosen targets an ad that silently installed Candiru spyware the instant it rendered. At least 45 devices at Al Jazeera were infected in 2024–2025. Nobody clicked anything. This 60-second check tells you your risk level and exactly how to shrink it. Free, no signup.

The 60-second risk check

Check whether you're in the targeted profile — mercenary spyware is sold to governments for targeted surveillance. The confirmed victims were journalists and media staff. Ask yourself honestly:

Are you a journalist, activist, lawyer, politician, or government staffer?
Do you work on stories or cases a government might want to surveil?

Yes to either → you are in the targetable population. Do step 2 and 3 today — not this weekend.

No → your direct risk is low, but the delivery channel touches everyone. Discover-Tech ads ran on ~200,000 websites and apps. The hygiene in steps 2–3 protects you against the whole class, not just this vendor.

Check your device hardening — zero-click ad attacks exploit the browser and OS rendering the ad. Hardened devices break the chain:

iPhone: Settings → Privacy & Security → Lockdown Mode → Turn On. This is Apple's built-in extreme-protection mode, designed exactly for mercenary-spyware targets.
Android: enable Advanced Protection (Settings → Security & privacy) and keep Google Play Protect on.
Both: install every pending OS and browser update now — spyware chains burn on unpatched rendering bugs.
Both: reset your advertising ID (iOS: Settings → Privacy & Security → Apple Advertising; Android: Settings → Privacy → Ads → Reset advertising ID) and enable "limit ad tracking" — this is the identifier the targeting pipeline keys on.

Lockdown Mode / Advanced Protection ON + fully updated + ad ID reset → best available posture against this attack class.

Check your network-level blocking — Citizen Lab and Confiant published indicators, including the ad-server domain mtrtb[.]com:

If you run Pi-hole, NextDNS, or a DNS filter: block mtrtb.com and watch Citizen Lab's report for additional IOCs.
Consider a tracker-blocking DNS (e.g. a filtered NextDNS profile) on your phone full-time — it neuters the ad-auction data collection this technique feeds on.
Use a content blocker in your mobile browser (e.g. 1Blocker on iOS, uBlock Origin on Android Firefox) — fewer ad slots rendered, fewer chances.

High-risk individuals (journalists, dissidents): contact Citizen Lab or a digital-security helpline like Access Now for a device check — don't rely on self-assessment alone.

Why this changes the threat model

The trusted-vendor badge was the cover. Discover-Tech sat on Google's certified-vendor lists and IAB Europe's approved list from 2020 until October 2026 — six years. Certification screened nobody.
Real-time bidding is a surveillance firehose. Every ad auction broadcasts device, location, and behavioral data to hundreds of bidders. Citizen Lab analyzed 4 billion Discover-Tech bidding records; the same data any bidder sees was used to pick targets.
Scale is the scary part. Beyond the 45 confirmed Al Jazeera infections, millions of devices were covertly directed to contact Candiru-linked servers — likely large-scale tracking and reconnaissance.
It's not over. Citizen Lab says a separate actor, DARK CARTOGRAPHER, is using the same infrastructure to exploit mobile-carrier vulnerabilities and link advertising IDs to phone numbers — mass de-anonymization. Full report forthcoming.

What to do right now

Update everything — phone OS, browsers, apps. Unpatched rendering engines are what zero-click chains burn on.
Turn on Lockdown Mode (iOS) or Advanced Protection (Android) if you're in any targeted profession.
Reset your advertising ID and limit ad tracking — starve the targeting pipeline of its key identifier.
Block the published IOCs at DNS level (mtrtb.com and any additions in Citizen Lab's report).
Don't trust vendor badges alone — "certified ad vendor" meant nothing here. Defense is device hardening, not supply-chain trust.

Hunt spyware infrastructure and IOCs → BreachHunter

This page checked one threat. BreachHunter tracks attacker infrastructure, malicious domains, and compromise indicators — the IOC-hunting side of stories like AdFection.