The Ad Was the Doorway

Citizen Lab says an ad vendor helped deliver spyware to Al Jazeera devices without a click. The case is real and narrow. Here is what it shows, and what it does not.

Picture a phone in someone's hand. They open a news site. A banner ad loads at the bottom of the page. They scroll past it without a thought.

That is the whole scene. No click, no download, no warning. This is an illustration, not a real person's story.

For almost everyone, that really is the whole story. For a small number of devices, Citizen Lab says, it was where the story began.

On October 15, Citizen Lab, a research group at the University of Toronto, published a report on a technique it calls AdFection. Unless we say otherwise, every fact in this piece comes from that report. Our own reading is labeled.

It says an Israeli company, Discover-Tech, bought ads that helped deliver spyware to Al Jazeera devices. The spyware comes from Candiru, a spyware maker that Citizen Lab says has rebranded as Integrity Labs. Devices at Al Jazeera were infected, and at least 45 were targeted in 2024 and 2025.

Citizen Lab links the attacks to Candiru with high confidence. That is its own judgment, not a court finding. We found no breakdown of how many of the 45 were infected.

It also calls this the first public technical confirmation of this kind of attack. Earlier reporting, including Haaretz in 2023 and Amnesty International in 2025, had touched on spyware and ads. Citizen Lab says how it works had stayed largely secret. Ad security firm Confiant published its own investigation alongside it.

What the evidence looks like

Al Jazeera gave Citizen Lab its network logs, and Citizen Lab says they show a clear sequence. Infected devices first contacted Discover-Tech's servers, which it says indicates an ad was shown. They then contacted a Candiru server that performs an initial check of the device. Finally, an infected device contacted a Candiru command-and-control server.

Al Jazeera also isolated a Windows file from one of the compromised devices. Citizen Lab analyzed it and concluded, with high confidence, that it is a newer version of a Candiru attack chain it captured in 2021.

A doorman with a guest list

Many of Discover-Tech's ads contained a small piece of code. When an ad loaded, the code sent the device's advertising or cookie ID to a Discover-Tech server. That server decided whether to send anything back. In Citizen Lab's general description of how these servers work, the decision apparently draws on the IP address and the ID.

For most people, it sent nothing.

Think of a doorman with a guest list. Most visitors walk past and see an ordinary door. If your name is on the list, the doorman hands you something. The analogy is imperfect, but it captures the point. The ad looked the same to everyone, and the decision happened out of sight.

Citizen Lab says this design let Discover-Tech avoid directly sharing malicious code, or even pointers to it, with the companies that run the ads.

Seeing an ad is not the same as being hacked

The numbers here can mislead, so it helps to separate three things. An impression is an ad being shown. Targeting is a device being picked. Infection is spyware actually running. Citizen Lab says an impression does not by itself confirm the other two.

It found Discover-Tech's bidding data for one of its ad platforms, MyDSP, exposed online, covering March to June 2026. In ad auctions, advertisers bid on the chance to show a specific ad to a specific user, and each of those chances is an impression. The platform bid on about 3.77 billion impressions and appeared to win about 442 million (11.7%). Ads that apparently carried the code were displayed in 75,373 apps and 120,768 websites. Those last two figures count ads actually shown, not bids.

That measures how widely the ads appeared. It does not measure how many people were attacked.

Citizen Lab also found Discover-Tech ads on research networks, including Australia's nuclear science agency, ANSTO. At minimum, it assesses, those impressions would have resulted in profiling by Discover-Tech. But ANSTO says it found no impact on its systems.

How did the ad system miss it?

From 2020 until 2026, Google listed Discover-Tech among its Ad Manager Certified External Vendors, Ad Technology Partners and Ads Personalization Providers. IAB Europe, an advertising industry group, listed it on the Global Vendor List for its Transparency & Consent Framework. These are separate lists from separate organizations, with different labels. Citizen Lab says the listings helped Discover-Tech appear to be a legitimate ad vendor and take part in the ad ecosystem at scale.

After Citizen Lab shared its findings, Google, IAB Europe, Beeswax, Vungle and Eskimi took action to disconnect it.

Citizen Lab says the case illustrates "structural flaws with the online advertising system." That is a serious argument. It is also an argument, not a measurement.

What this shows, and what it does not

Here is our reading, and it is ours. Advertising systems are built to show a specific ad to a specific person, using IDs tied to their device. Ads can also include code that runs in an app or browser. Citizen Lab documents one company using both together. Our reading is that tools already built into advertising can be turned into part of a spyware attack.

That is a narrow claim. Citizen Lab documents one company, one victim organization and one route. We do not claim this is common across ad tech.

The limits are real. The abuse is tied to one vendor. The scale figures measure ad activity, not infections. Confiant says the Candiru-linked campaigns ran at hundreds to a few thousand impressions a day in its data, far below the roughly 10 million a day it estimates for Discover-Tech overall, and that it has not captured a full exploit chain. Ad companies acted once the evidence came out. We do not know which governments were behind the attacks, and the evidence does not show how common this technique is.

None of that erases Citizen Lab's own argument that the advertising system failed to detect or prevent the abuse. It does mean this is one case, not a pattern.

The question that is left

Most of us scroll past ads without thinking. That habit rests on a simple idea: an ad is something you look at, and the danger is something you click.

If Citizen Lab is right, this case weakens that idea for at least one set of targets. It does not mean every ad is a threat. The evidence points to one company and a specific set of targets, not to a general danger.

What it does raise is a plainer question. If an ad can be a doorway, who is responsible for watching it?

Read the full analysis, with sources, on Ludicarc

Ludicarc covers technology, cybersecurity, and the forces reshaping online advertising. Read more at ludicarc.com