Researchers expose system for infecting smartphones via online advertising
Researchers from the University of Toronto have uncovered a large-scale digital surveillance system that used ordinary online advertising to track users and covertly infect their devices with spyware. The victim did not even need to click on the ad for the attack to occur.
This is according to Citizen Lab research published on October 15, 2026. The investigation was conducted jointly with experts from Confiant, as also reported by TechCrunch and Politico.
At the center of the investigation was the Israeli company Discover-Tech, which positions itself as a provider of advertising technologies. According to researchers, its infrastructure was used to distribute commercial spyware, including Candiru, which now operates under the name Integrity Labs.
The technology was named AdFection. It allowed infecting a device at the moment an ad loaded without any user action. This is the first publicly confirmed case of using such a mechanism to distribute commercial spyware.
Infection via ordinary ads
The Controlium platform developed by Discover-Tech was used for the attacks. It allowed tracking specific users by IP addresses, advertising identifiers, and other digital device characteristics.
When a person opened a site or app with the relevant ad, hidden code transmitted device information to Discover-Tech servers. If the user was selected as a target, the system could load additional malicious code that exploited software vulnerabilities to install spyware tools.
Using this mechanism, operators could access information on the device and conduct covert surveillance. The ordinary ad itself did not necessarily contain malicious code; it was loaded separately only for selected targets, which made detection of the attack more difficult.
Researchers confirmed the use of this technology against the international broadcaster Al Jazeera. In 2024–2025, at least 45 devices belonging to the organization were targeted. Analysis of network traffic and the malware confirmed that devices were infected with Candiru spyware.
Millions of devices entered the surveillance system
During the investigation, experts analyzed about 4 billion records of Discover-Tech ad auctions over a four-month period in 2026.
It turned out that the company's ads appeared on nearly 200,000 websites and apps for Android and iOS in dozens of countries. Among them were popular services Viber, Duolingo, Truecaller, Yahoo Mail, and others.
In addition, Discover-Tech ads were detected on devices belonging to networks associated with NATO, the United Nations, the European Commission, the European Parliament, government agencies, and critical infrastructure.
According to Citizen Lab, millions of devices established hidden connections to servers associated with the spyware infrastructure. This allowed collecting data for surveillance and identifying potential targets.
However, researchers emphasize that displaying an ad does not mean the device was automatically infected. The scale of confirmed infections is significantly smaller than the number of users whose data may have been collected through the ad system.
Google and ad platforms restricted the company's access
After receiving the investigation results, Google suspended Discover-Tech's access to its ad exchanges. The European industry organization IAB Europe also removed the company from its registry of ad tech vendors.
Similar measures were taken by ad platforms Beeswax, Vungle, and Eskimi. Previously, Discover-Tech had been on approved ad provider lists for several years.
Researchers are calling on technology companies and regulators to strengthen vetting of ad market participants. To protect against such attacks, experts also recommend blocking potentially dangerous ads, since even a lack of interaction with an ad does not guarantee safety.
Based on materials from: Citizen Lab, TechCrunch, Politico
