What the AdFection report means, explained by someone who sells ads. Part 1 of 3.
By Tabish Hasan, CEO and co-founder of Muslim Ad Network
An ad delivered spyware to a newsroom. Nobody clicked on anything.
That sentence should stop everyone in my industry. I sell ads. I run Muslim Ad Network, and it has run campaigns since 2009. I have also built ad products at two demand-side platforms, Viant and Basis, the systems advertisers use to buy ads.
So you should know my conflict of interest before you read on. MAN sells advertising through the same kind of supply chain this story is about.
I am writing anyway. The people most exposed in this data are people we serve. And we are Muslims who know this industry from the inside. When the ad system is turned against our communities, explaining it plainly is not marketing. It is our obligation.
This is Part 1 of a short series. It covers what happened, how it worked, and what it means for anyone who buys or sells ads. Part 2 shows the mechanism in a short animation. Part 3 goes deeper into the companies, the people and the law.
The short version
- On 15 October 2026 the Citizen Lab at the University of Toronto published what it calls the first-ever public confirmation of zero-click mercenary spyware delivered through targeted ads. It named the technique AdFection.
- Devices at Al Jazeera were infected. At least 45 devices there were targeted in 2024 and 2025. The spyware was Candiru's, an Israeli spyware vendor on the US Entity List since 2021.
- The ads were bought by Discover-Tech, an Israeli company that presented itself as an ordinary ad business.
- The trick was simple. The ad called home. The server checked who was looking. A chosen target got code. Everyone else got an empty answer, so there was nothing for a scanner to find.
- It ran on mainstream pipes. About 92% of the bids in Discover-Tech's own records went through two exchanges: Yandex (67.4%) and Google Ad Manager (24.74%).
- The trust badges did not catch it. Nothing in the record says the ad platforms knew. The Citizen Lab says they were "not necessarily aware". But the checks we all rely on were not built to catch this.
What did the researchers actually prove?
A lot of the commentary online has blurred three different things. I want to keep them apart.
What the Citizen Lab documented directly. Network logs from Al Jazeera show the same sequence again and again: contact with Discover-Tech domains, then a Candiru validator server, then a Candiru command server. The lab recovered a Windows file from one compromised device. Its hardcoded servers matched a Candiru fingerprint the lab had built. The lab also found the exposed source code of a Discover-Tech platform called Controlium, login records from an endpoint that needed no password, and almost four billion ad bidding records left open on a Discover-Tech server.
What it assessed. The lab says Discover-Tech "appears" to be a front, and that being a bridge to spyware vendors "appears" to be its main purpose. It links the Al Jazeera attack to Candiru with "high confidence". That is the researchers' own confidence level. It is not a court finding.
What nobody has established. Which government, if any, paid for the access. The Citizen Lab names no sponsor. Anyone who tells you otherwise is going past the evidence.
How did an ad deliver spyware?
This is the part worth reading slowly. The trick is simple, and it explains why years of industry vetting missed it.
When you open an app or a web page that carries ads, an auction runs. It takes less than a second. The app or page says what it knows about you and about the ad slot. Advertisers bid. The winner's ad appears on your screen. All of this is ordinary. It is how most of the free internet is paid for.
Discover-Tech took part in those auctions like any other advertiser. Its ads looked normal. One the Citizen Lab shows is a plain "SALE" banner for electronics.
But many of the ads carried a small script. When the ad loaded, the script sent your advertising ID or cookie ID to a Discover-Tech server. Then it ran whatever code the server sent back.
The server made one decision. It looked at your IP address and your advertising identifiers. It asked one question: is this device on the list?
- If yes, it sent code that led to the spyware.
- If no, it sent nothing. A response of zero bytes.
That empty answer is the whole trick. Almost everyone got nothing, so there was nothing to inspect, flag or scan. The Citizen Lab says the design let Discover-Tech "avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads." The companies in the middle saw a clean ad.
The people who got nothing still gave something. The ads collected data from the browser and sent it back, including cookies set on the page and the device's public IPv6 address. The Citizen Lab says this was likely for large-scale tracking and reconnaissance. You did not have to be a target to be on the map.
Confiant, an ad security firm, investigated alongside the Citizen Lab. Its scanner first caught one of these ads on 12 April 2026. When it did catch a payload, it found about 90 kilobytes of hidden JavaScript dressed up as a verification tool. The code checked in with a command server once a second and could run any code it was sent. It carried a decoy header, "Copyright 2013 Google Inc.", which Confiant says was there to reassure a human reviewer. And it encrypted what it collected, so that nobody else in the chain could read it.
Confiant also found the chain reading cookies on more than 1,000 publisher sites, where the ad code ran inside the page instead of a sealed frame. In many cases that included the sessions of logged-in users, and sometimes emails and full names. Readers who were never targets were still caught in it.
How big was it?
These numbers come from Discover-Tech's own exposed bidding database, as analysed by the Citizen Lab. They cover March to June 2026 unless I say otherwise.
| Measure | Figure |
|---|---|
| Bids placed by Discover-Tech's buying platform, MyDSP | 3,770,286,576 |
| Impressions won | 441,954,291 (11.7%) |
| Bids for ads that apparently carried the attacker's script | at least 718,748,885 (about 19%) |
| Apps that showed these ads | 75,373 |
| Websites that showed these ads | 120,768 |
| Countries the bids were aimed at, by IP address | 161 |
| Eligible users sent to one Discover-Tech server, January to June 2026 | 3,637,213 |
| Recorded media spend | about USD 109,091 |
Two notes, because precision matters here. The spend figure assumes the database records cost in millionths of a dollar, as the Citizen Lab does. And the Citizen Lab says customers other than Candiru may also have used the server feature behind the 3,637,213 figure.
Read the last row again. A spyware delivery system this size ran on about one hundred and nine thousand dollars of recorded ad spend. Cheap inventory was not a side detail. It was the method.
The heaviest exposure was not in the West. By raw bids, the top countries were Yemen (457,283,658), Pakistan (139,427,322) and Montenegro (97,595,716). Per person, the leaders were Montenegro, Yemen and Armenia. Confiant found that Palestine was by far the most targeted place: one in 36 Android ads served in Palestine during the period came from Discover-Tech.
One limit I will not stretch. An ad impression is not an infection. The Citizen Lab says so plainly. Its data shows impressions on government networks in many countries, including defence and foreign ministries. The right word for those networks is exposed. Not hacked.
Why did the trust badges not catch it?
This is the part that should embarrass my industry.
Discover-Tech sat on four of Google's vendor lists from 2020 until early October 2026. One of them is the list of roughly 2,400 certified external vendors. Google's own record for Discover-Tech carried two fields: "Can access Google Display Network: Yes" and "Needs to be declared: No". Under that setting, a publisher on Google's stack was not required to tell its users this vendor was there.
Discover-Tech also sat on IAB Europe's Global Vendor List, the registry behind the consent pop-ups Europeans see every day, as vendor 778 from July 2020 to 8 October 2026. The Citizen Lab writes that this potentially meant hundreds of millions of Europeans were shown a consent request that covered this company.
And it showed a "Verified by TAG" badge on its own website.
Then there is the sentence I keep coming back to. Eskimi, one of the platforms Discover-Tech bought through, told the Citizen Lab in writing that "the advertiser's tags were built to evade automated scanning." It said the tags "loaded different code depending on who was viewing the ad, including the device, IP address and location," and that campaigns "were often restricted to very narrow IP target lists." Then: "This is how they passed third-party verification."
To be fair to Eskimi, it also wrote that "Our own monitoring flagged this behaviour," that it stopped campaigns and tags as its controls caught them, and that Discover-Tech's activity with it stayed at "only a few hundred dollars in media spend."
But read the core of it again. A company in my industry said on the record that the verification layer did not work. I sell advertising. I have pointed at that layer too.
And the warning came early. In July 2023 the Israeli business paper Globes reported that Israel's defence ministry had barred one company, Rayzone, from exporting a product "enabling mobile phones to be infected by spyware through user exposure to online ads." A regulator saw this method three years ago. The ad industry's own checks still did not.
I am not accusing anyone of knowing. The Citizen Lab says the ad vendors were "not necessarily aware" of how their systems were being used. I do not accuse Google, Yandex, Comcast, Liftoff, Microsoft or Eskimi of knowing anything. The finding is worse than a conspiracy, and much easier to fix. A whole vetting system ran on self-description, and the checks were not built to catch an ad that changes depending on who is looking.
Who was in the chain
| Company | Its role in the record | What it did after |
|---|---|---|
| Exchange (Google Ad Manager). Listed Discover-Tech as a certified vendor from 2020 | Helped the investigation. Ended Discover-Tech's access to its ad exchange platforms. Added Safe Browsing warnings | |
| Yandex | Exchange. 67.4% of the bids. Synced user IDs with Discover-Tech | The report records no action and no response from Yandex |
| Beeswax (Comcast) | Buying platform. Discover-Tech also synced IDs with it | Removed Discover-Tech from its Buyer Cloud |
| Vungle (Liftoff) | Mobile exchange. 7.24% of the bids. Its code is in 150,000 apps, by its own count | Paused access pending review. Said it was not in a position to confirm or comment on the report's specific assertions |
| Eskimi | Buying platform. Discover-Tech was a self-service advertiser there from 2022 | Blocked all its accounts, users and domains. Shared technical indicators |
| Sunteng | Exchange. 0.03% of the bids | Did not respond |
| Xandr (Microsoft) | Discover-Tech retrieved and synced its user identifiers | Did not respond |
Were Muslims in the West targeted?
This is my own community's question. I will answer it as carefully as I can, not as conveniently as I can.
There is no evidence that Muslims in the US, the UK or Canada were targeted. The UK and Canada do not appear in the report's named country tables. The United States appears only in a group with more than ten million bids, and the Citizen Lab notes that the US, Dutch and German locations seemed to come mostly from VPNs or servers. The bid data covered 161 countries, and most of them are never named.
So if you are a Muslim in Chicago, Bradford or Mississauga, nobody should tell you that you were targeted.
But we were in the room. These ads ran inside apps that Muslims in the West use every day. The report names Viber, MX Player, Truecaller, Duolingo, Yahoo Mail, Opera Mini, the game Ludo STAR, and the religious app WeMuslim. And the long tail of websites that showed ads carrying the attacker's script includes bbc.com, cbc.ca and nytimes.com. The method does not need anyone to choose you. It needs you to open an app that carries ads. By raw bids, exposure was heaviest in Yemen and Pakistan, and Confiant found the highest share of these ads in Palestine. Cheap ad inventory reaches people there. Nobody had to pick each person.
And this vendor family has reached the UK before. In 2021, Microsoft counted Candiru victims in ten countries, the United Kingdom among them.
Who was behind it?
The careful answer has two halves.
What the record shows. This class of spyware is a commercial product sold to governments. Candiru is on a US export blacklist because its tools were used against journalists and activists. The Citizen Lab traced logins to a Discover-Tech platform from eight countries. One Candiru infection link pointed at an IP address of the Saudi Ministry of Foreign Affairs, which the lab reads as a potential target.
The record also shows where the expertise came from. The Citizen Lab links Discover-Tech to Bindecy, which presents itself as a cybersecurity firm founded by Israeli military intelligence alumni. Intelligence Online reported that Bindecy holds offensive cyber contracts from the Israeli intelligence services. Eric Banoun sat on Discover-Tech's board from 2020 to 2025; Haaretz calls him one of the pioneers of offensive cyber in Israel.
What it does not show. Who paid. No government has been named as the sponsor of the Al Jazeera attack, and Discover-Tech's client list is unknown. Military intelligence backgrounds and intelligence contracts show capability and reach. They do not show who gave the orders, and I will not blur the two to make the story bigger. Part 3 sets out the companies and the people, with a source for every line.
One more fact, weighed lightly. The report also records Discover-Tech impressions on Israeli government networks, including the Ministry of Defence. An impression is not a target, so it proves nothing either way.
My one-line summary: governments are the customers for this class of tool, someone paid for this access, and nobody has yet named them, including the researchers who proved it.
What does this mean if you buy or sell ads?
Every exchange and buying platform in this story sat in the chain those impressions moved through, and each one is paid at its step. Nothing in the record says they knew what the ads were for. The money moved anyway. And nobody in that chain is paid to slow down and look. That is why so much of our vetting is a form and not a check.
I have spent most of my working life in this industry. I have watched us treat an ad as if it were a picture. It is not. An ad is code that runs on someone else's device, in a slot we sold, delivered by a chain none of us can fully see. That sentence is the whole security problem.
If we cannot fix it, ad blocking stops being a privacy choice and becomes basic security. The Citizen Lab already tells high-risk people to block ads at the network level, for example at the home router. The US National Security Agency published guidance on blocking ads at the network back in 2018. When the defenders decide the safest ad is the one that never loads, every publisher who lives on advertising pays for it.
So here are the questions I would ask any ad network, including mine:
- Can an ad on your inventory run code that it fetches from a third-party server at the moment it is viewed?
- Do you approve an ad by its exact file, and send it back to review if it changes?
- Who reviews ads before they run? Name the team and the role, not a badge.
- Do you verify who an advertiser really is before the first impression?
- Will you tell me, in writing, what you cannot do yet?
What MAN does today, and what we cannot claim yet
I will not publish a list of principles and let you assume we meet them. We checked our own stack before writing this. Here is what we found.
What we can say today. These are about our MuslimReach Marketplace, the rail we built and run ourselves.
- The call that picks the ad never sees the person. It receives the page's text and nothing else: no cookie, no IP address, no advertising ID. A target list like Discover-Tech's has nothing to match against. The call that counts a view does see an IP address and browser string for a moment, only to remove duplicates and bots.
- The ad is built into the page on our server. Your browser receives an ad, not a script that goes and fetches one. That removes the exact mechanism in this report.
- We report ad views, not people. No "families reached". No adding two platforms into one bigger number.
- If we under-deliver on the Marketplace, the refund is automatic and pro-rata.
What we cannot claim yet. This is the honest part.
- Our other ad rail works like most of the industry. It serves ads on our own sites. The page loads a third-party script from an external host, and that script fetches the ad. That is ordinary ad serving. It is also the same shape as the mechanism in this report. On that rail, we cannot yet claim what we are asking the industry to do.
- Our own domain declares us twice. Buyers check a file called sellers.json to see who is authorised to sell. Our permanent seller domain, exchange.muslimadnetwork.com, publishes one. Our main website still serves an older file that disagrees with it. We will retire the older file.
- We do not yet lock an approved ad to its exact file, and we have not yet published a named function that reviews ads before they run.
Next, we will publish a dated plan for each of these gaps, with the role that answers for it. A plan is not a fix, so until each gap is closed, its line stays here.
We are checking our own systems now. The Citizen Lab and Eskimi published the domains Discover-Tech used. We have started checking our own ad paths, partners and records for them. We will publish what we find, either way.
We have corrected our own words before. We used to call our MuslimReach venue an exchange. Then we checked how it actually worked, and there was no auction. The publisher set the price. So we changed the name to the MuslimReach Marketplace, and the board now says plainly that we do not set the price. The publishers do. A badge is not a control. Neither is a word you have not earned.
What you can do today
From the Citizen Lab's own guidance:
- Use a trusted ad blocker in your browser.
- Reset your phone's advertising ID regularly, and turn off ad tracking.
- If you face higher risk, block ads on your network, for example at your home router.
- If you defend an organisation, watch the traffic that ad impressions create, and block online advertising at your gateway.
From me:
- On an iPhone, turn on Lockdown Mode. On Android, turn on Advanced Protection. Both are built for people at higher risk.
- Keep your phone and browser updated. These attacks need a working exploit, and updates break exploits.
- If you run a website or an app, ask your ad partners the five questions above. If the answer to the first is not a flat no, with the mechanism behind it, you have your answer.
What is still unknown
- How many devices were infected beyond Al Jazeera. Bids are not impressions, and impressions are not infections. Nobody outside the operation knows the funnel.
- The exploit. The Citizen Lab recovered the implant, not the exploit. The report does not name the vulnerability used in the Al Jazeera attacks.
- Who paid. Unknown.
- DARK CARTOGRAPHER. The Citizen Lab says another actor has used Discover-Tech's ads since at least 2019 to link advertising IDs to phone numbers, by exploiting weaknesses across many mobile carriers. It does not yet name the two parties it links to that actor, which it describes as a mercenary adtech vendor and a US government contractor. A second report will follow once disclosure to the carriers is complete. It may be the bigger story.
Next in this series
Part 2 shows the mechanism in a short animation: the auction, the hidden script, the empty answer and the one device that got the payload. Part 3 goes deeper into the companies, the people and the law.
Ask any ad network that wants your budget the five questions above. Ask us too. We will answer in writing, including where the honest answer is "not yet". If any company named here wants to reply, we will publish the reply in full. If we got something wrong, tell us, and we will correct it in place and say what changed.
Tabish Hasan is CEO and co-founder of Muslim Ad Network, which has run campaigns since 2009. He has built ad products at two demand-side platforms, Viant and Basis.
Sources
Primary research - Citizen Lab, "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware", 15 October 2026. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ - Confiant, "ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming", 15 October 2026. https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming - Citizen Lab, "Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus", 15 July 2021. https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
Government and regulatory - US Commerce Department, Candiru and NSO Group added to the Entity List, 3 November 2021. https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list - US Treasury, sanctions on members of the Intellexa consortium, 2024. https://home.treasury.gov/news/press-releases/jy2155 - US National Security Agency, "Blocking Unnecessary Advertising Web Content", July 2018. - Assaf Gilead, Globes, on Israel's export controls for advertising intelligence (ADINT), 16 July 2023.
Company statements - Eskimi, Beeswax, Vungle and Google responses, as published in the Citizen Lab report, October 2026. - IAB Europe, statement on Discover-Tech and the Global Vendor List, 15 October 2026. https://iabeurope.eu/recent-reports-concerning-a-tcf-vendor-discover-tech/
Reporting - The Guardian, 15 October 2026. https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say - Reuters, 15 October 2026. https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/ - Al Jazeera, 16 October 2026. https://www.aljazeera.com/news/2026/10/16/how-israeli-firms-zero-click-malware-attack-poses-global-security-risk - WIRED. https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/ - Ars Technica. https://arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/
On method. Every number here comes from the Citizen Lab's analysis of Discover-Tech's own records, or from Confiant where I say so. Every company response is quoted from that company's own written reply. Where the record is silent, I say unknown.