Hot Tracking 022 | Ads Confirmed as a Spyware Pipeline for the First Time: Stayed on the Certified List for Six Years

First, fix the date. On October 15th, the Citizen Lab at the University of Toronto released Report No. 195, “Exposing AdFection,” authored by Bill Marczak, John Scott-Railton, Ron Deibert, and others. The report states that this is the first publicly confirmed zero-click commercial spyware attack delivered through targeted online advertising, a technique Citizen Lab names AdFection. On the same day, the advertising security company Confiant released supporting evidence for the investigation. On the dissemination side, related posts quickly topped Hacker News’ hot lists that night, with over 340 upvotes and more than 500 comments as of the morning of October 16th, and the number continues to rise. The 48-hour window is from October 15th to October 17th, and this article covers the period within. The statement should be clear: “The first confirmation” is Citizen Lab’s own claim; this article retains that original statement without any alteration. All subsequent facts are cited with sources, and opinions in the comments are attributed individually.

What Happened

Key Fact 1: News organization equipment was infected with spyware. The report confirms that equipment on Al Jazeera’s international news network was infected with commercial spyware by the Israeli company Candiru, through targeted online advertising. Candiru has now changed its name to “Integrity Labs.” The report does not provide details about how many devices were infected or when this occurred, so we will not fill in those gaps here.

Key Fact 2: The advertising buyer was a partner of the spyware. Malicious ads were purchased by the Israeli company Discover-Tech, which claims to be a legitimate advertising company. However, Citizen Lab found that it acted as a partner for several commercial spyware manufacturers, including Candiru, Intelos, and Bindecy. This company operates a platform called Controlium, which allows partners to anonymize, fingerprint, and automatically infect devices the moment ads are displayed—essentially a zero-click attack: users do not need to click anything; ads appear, and the attack is already completed.

Key Fact 3: The scale was ecological. Citizen Lab analyzed 4 billion bidding records from Discover-Tech and found that within four months, its ads appeared on nearly 200,000 independent websites and Android and iOS apps across dozens of countries. The report also discovered that Discover-Tech’s advertising secrets directed millions of devices to connect to Candiru’s servers, which the report believes could be used for large-scale tracking and reconnaissance. Another threat named DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities in multiple mobile operators, linking device advertising IDs with phone numbers—details are left for subsequent reports.

The mechanism is worth discussing in detail, as it is the coldest part of this report. Most advertisements you see today are generated through Real-Time Bidding (RTB): advertisers bid for the opportunity to “display an advertisement to a specific user,” with bids managed by advertising exchanges like Google, with scales reaching hundreds of billions per day. Advertisements are not just images and videos; they also contain HTML and JavaScript code, linking to one or more domain names, used to track exposure and clicks. Advertisers also synchronize IDs, exchanging user identifiers to identify you across websites and advertisers, creating profiles for targeted advertising. Discover-Tech operates from the legitimate entrance of this infrastructure: it has its own advertising buying platform, MyDSP, participating in bidding like any legitimate buyer. The advertisements themselves seem harmless, with reviews summarizing them as game banners, e-commerce promotions, IP search sites, etc., but each advertisement hides a small script that quietly reconnects during rendering. The targeting capability is also readily available; the report indicates that by using gender, age, location, and several other validation conditions, ad networks can almost uniquely identify an individual. In essence, attackers do not need to hack any websites; they just need to put in a bid, and the rest is handled by the advertising ecosystem. This infrastructure was originally designed to “deliver ads to the most likely buyers,” with higher commercial value resulting from more accurate targeting. Now, the same precision is used to deliver vulnerabilities to those who should be monitored the most. For the target, being selected is not because they clicked something, but because their profile matches the buyer’s bid conditions.

The certification list has been up for six years: Criticism on Mainstream

The first irony lies in certification. According to the report, Discover-Tech has been listed as a “certified” or “approved” supplier on Google and industry organization IAB Europe’s lists of suppliers from 2020 to 2026, and has been advertising on major networks like Google, Yandex, and Beeswax. Over six years, the industry’s security review mechanisms failed to stop any spyware partners until independent researchers disclosed that the list was updated in early October. The question here is not “why there are bad people,” but “what exactly is being reviewed in certification.”

The second irony lies in compliance cover-ups. The report found that Discover-Tech also used the EU GDPR consent framework, namely IAB’s TCF, to target users within the EU, making itself appear compliant. The regulatory framework designed to protect privacy, such as consent pop-ups and cookie banners, is now used as a cover for targeted advertising. Compliance does not equal security; this is the most stark example at present.

The third point is name change. After being named, Candiru was renamed Integrity Labs, as specifically noted in the report. A spyware manufacturer exposed by multiple research institutions and media around the world continued operations with a new name, and this time the name included the word “integrity.”

The report’s structural conclusions are written in the subheading: AdFection indicates that online advertising is a cybersecurity and privacy crisis. The advertising system failed to detect or prevent the abuse recorded in the report. The report also warns that, in the context of state actors, malicious advertisements can be delivered through apps and websites used by defense personnel, political leaders, and critical infrastructure maintainers, posing a national security risk to the country itself. The report calls on regulatory agencies to investigate whether Discover-Tech and Candiru are illegal.

The official statement does not match: Who is pretending to be alive

Citizen Lab requested comments from 13 companies, and the full responses are included in the Correspondence section of the report. According to the report, only five companies took real action after the disclosure: Google participated in the investigation and then, together with IAB Europe, removed Discover-Tech from the supplier registry and banned it from accessing advertising platforms; Beeswax removed it from its ad purchase platform; Vungle (Liftoff) suspended access and began monitoring; Eskimi banned its account and domain. The remaining involved ad suppliers did not respond to the comment request within the deadline, according to the report. Note the wording: it’s “did not respond,” not “refused.” This article does not name any specific entity as being inactive, but readers can figure it out by themselves: of the 13 companies questioned, only 5 took action.

Another point worth noting is the timeline: Google and IAB Europe’s removal actions occurred in early October, and Google acted “after participating in the investigation.” This means that the update to the certification list was not the result of industry self-inspection; it happened after the research team obtained the evidence.

What’s the Discussion Section Saying

More than 500 comments on HN can be roughly divided into several factions. Below is a summary, which does not represent the position of this article.

The mechanism faction is analyzing the attack paths. User chunkyslink’s summary received high praise: It entered through the main door, was listed as a certified supplier by Google and IAB Europe for six years, appeared harmless, but each one contained small scripts that quietly reconnected during rendering. User reactordev speculated that malicious code was hidden in images in the cache, allowing access to any site that displayed those ads. User oulipo added a positioning logic: using the advertising network to target individuals, then placing an ad exploiting vulnerabilities, such as a corrupted JPEG decoder, to gain control of the device. User pelagicAustral said, “The narrative that ‘file formats have connections with intelligence agencies’ sounds crazy, but other zero-click attacks indeed rely on damaging file parsing, and messages can be hacked even without being opened.”

The industry critique faction also has significant influence. User Lio cited a Reuters report stating that Meta’s billions in advertising revenue comes from illegal content such as fraud and illegal gambling. U.S. government agencies like ICE have also purchased software that uses advertising technology to track people’s locations. His conclusion is: It’s unclear whether ad blockers can stop Controlium, but to this day, allowing ads in browsers is foolish—the advertising industry as a whole is quite dark. It must be noted: This is a summary from the discussion section plus personal judgment, and this article only provides a record.

The debate over defense effectiveness is the most intense. User andunie believes the situation is worse than imagined, with attackers able to fully control machines through vulnerabilities, and using privacy messaging services like Signal is ineffective in such cases. He also worries that Google’s tightening of Android sideloading won’t prevent this type of attack; instead, it might be used to justify further platform closure. User gruez counterposes that limiting sideloading was intended to prevent social engineering and fraud, not zero-day vulnerabilities. User Cider9986 argues that “it’s completely useless” is incorrect; hiring spyware companies is much more expensive than bribing insiders or getting judges to issue orders. He trusts the privacy of messages on GrapheneOS devices, focusing on the threat model. User hotelsacher adds coldly: Google simply wants to protect its own assets, which means having the ability to monitor users’ every move. It doesn’t need to harm users; it already has all the data. Other users, room606 and beel, directly link to Citizen Lab and Confiant’s original reports. The community consensus is clear: for incidents of this scale, reading the original texts is more valuable than summaries. In the comments section, some also mention past cases like Pegasus. This article only quotes this sentence, without making parallel arguments.

Three things ordinary users can do

First, block ads. The report concludes that given the reality of threats and evidence of large-scale targeting, the most feasible protection now is for defenders to intercept targeted ads at the gateway layer. This advice remains valid until it is proven in the industry that it can reliably block all AdFection-like vectors. For individuals: install blockers like uBlock Origin in browsers, and use solutions like Pi-hole at the router level. Lio in the comments section shares the same view.

Second, high-risk individuals should isolate their devices. The report targets news organizations, but also mentions that military personnel, political leaders, and critical infrastructure maintainers are also potential targets. If you’re a journalist, rights activist, or working in sensitive roles, physically separate “websites viewed” from “servers storing sensitive data.” This is the simplest and most effective action under the threat model.

Third, reduce identifier submission and consent. Turn off “Allow App to Request Tracking” on iOS, and regularly reset the advertising ID on Android. For cookies and consent pop-ups, choose the strictest settings. Note: The report confirms that ID syncing and TCF consent frameworks are used for cross-site tracking, but these actions can only reduce the accuracy of your profile data and cannot prevent targeted poisoning itself. This article does not exaggerate its effectiveness.

Conclusion

Caution Note: This article does not implicate any party. “First public confirmation” is the self-description by Citizen Lab; Discover-Tech is an Israeli company, Al Jazeera is a Qatari media outlet, and Candiru’s connection to Israel is stated as per the original report; this article does not elevate geopolitical issues. The term “likely used for large-scale tracking and reconnaissance” retains the restrictive nature of the report; specific details about Al Jazeera’s infected equipment are undisclosed in this article. Opinions in the comments section belong entirely to the commenters. Verified facts include: Citizen Lab Report No. 195 was released on October 15, containing 4 billion bidding records, nearly 200,000 sites and applications, four names of spyware-related threat actors, a list of certified entities from 2020 to 2026, and actions taken against five companies, all from the original report. Two points requiring attention: first, whether Discover-Tech or Candiru (Integrity Labs) has provided a formal response; currently, the report indicates no response within the deadline. Second, whether regulatory authorities have initiated investigations; the report explicitly calls for regulatory intervention. If either occurs, a v2 will be released.

Reference Sources

• Citizen Lab Report 195 “Exposing AdFection”: Published on October 15, 2026, at citizenlab.ca; the full text is the direct source of all hard facts in this article.
• HN story 50101813: Algolia data, submitted on 10-15T18:43, with a snapshot of 349▲/506💬 on 10-16 morning; the text uses the claim of “over 340▲, more than 500 comments.”
• Confiant cooperating with investigations (blog.confiant.com): Published on the same day as the report, with HN comments cited; the full text was not directly extracted, only stating “published on the same day.”
• Reuters report on Meta’s advertising revenue: Cited by user Lio in the comments section, secondary source; the text is marked “cited from comments section.”
• HN comment pool: chunkyslink/reactordev/oulipo/pelagicAustral/Lio/andonie/gruez/Cider9986/hotelsacher/room606/beel are all self-descriptions by commenters; the text is attributed to each one individually.