> ## Content Index > Fetch the complete content index at: https://agarhouse.com/llms.txt > Use this file to discover other available public pages before exploring further. # Spyware delivered through ads makes 'don't click' incomplete advice - URL: https://agarhouse.com/adfection-spyware-ads-blocking-tracking-2026-10-16-0800/ - Published: 2026-10-16T12:00:00.000Z - Updated: 2026-10-16T12:00:00.000Z - Description: Citizen Lab traced spyware attacks to targeted ads that needed no click. What the evidence shows, and which privacy measures can reduce your exposure. - Author: Gary Agar - Tags: Cybersecurity, News, Privacy, #agarhouse-slot-2026-10-16-0800, #agarhouse-content-11e6fa22dffcab89d410693e0f1b6f3a796b61bb4b5b825009f801e2c6af22b3 You can avoid suspicious downloads and refuse to click an ad, yet still miss the way an attack reaches your computer. Citizen Lab's October 15 investigation describes spyware delivered through targeted advertisements simply when the ads loaded. The researchers call the technique AdFection. That is a good reason to reconsider ad blocking as a security measure. It is not evidence that everyone who sees an online ad has been hacked. ## What the researchers found Citizen Lab says devices at Al Jazeera were infected with spyware linked to Candiru, a commercial surveillance vendor now called Integrity Labs, through ads purchased by Israeli advertising company Discover-Tech. At least 45 devices at the news organization were targeted in 2024 and 2025\. The attacks are older; the public technical findings are new. The distinction between targeted and infected matters. The report does not give us permission to describe every ad impression, or every device reached by the advertising system, as a successful compromise. Researchers examined Al Jazeera's network logs and a Windows spyware file recovered from a compromised device. They traced a sequence from advertising infrastructure to servers that checked a potential target, and then to spyware command-and-control servers. Citizen Lab attributes the spyware to Candiru with high confidence. The Verge's reporting also describes the targeting and the advertising companies' response. ## An ad can run code before you touch it An online advertisement can contain code as well as a picture or video. In this case, loading an ad caused the browser or app to request additional code from Discover-Tech's infrastructure. According to Citizen Lab, its Controlium platform allowed customers to select people for profiling or infection using information such as an IP address, a browser identifier or a mobile advertising ID. Most users seeing one of these ads were not selected to receive the attack code, although the ads could still collect information about them. That selective behavior helps explain why a suspicious ad might appear harmless during one inspection. It also means a familiar website is not enough reassurance: the advertising system can bring in code from companies the reader never chose to visit. ## What you can change I would treat this as a reason to review how ads and trackers reach your devices, rather than rush to install an unfamiliar security app. Start with a trusted ad-blocking extension for your browser. Citizen Lab also recommends a privacy-respecting browser that limits tracking and data collection. Check that the protection is enabled on the browser you use regularly, not just one installed as a backup. Review your phone's advertising and tracking settings. The researchers recommend resetting mobile advertising IDs, disabling ad tracking and using apps' opt-out controls. These reduce information available for targeting; they are not a test for whether spyware is present. For a home or office network, consider ad blocking at the router or gateway too. Browser protection alone does not cover everything an app might load. Citizen Lab recommends blocking at both the device and network level where possible. None of these measures should be read as a guarantee against every spyware attack. If your work puts you at elevated risk of targeted surveillance, seek expert security help. Installing a blocker is not a substitute for investigating a suspected compromise. ## The advertising companies have work to do Google told Citizen Lab it terminated Discover-Tech's access to its ad exchanges. Beeswax also removed the company, while Vungle paused its access for review. Citizen Lab says Discover-Tech and Candiru did not respond by its deadline. Those actions address this operator. They do not make the underlying delivery method disappear. Readers can reduce exposure, but ad platforms need to prevent their systems from delivering attack code in the first place. Telling people to be more careful about clicking does not solve an attack that requires no click. ## Sources - [Citizen Lab: Exposing AdFection, technical findings and protection recommendations](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=agarhouse.com) - [The Verge: An Israeli firm is sending spyware through online ads, researchers say](https://www.theverge.com/tech/1011956/discover-tech-zero-click-ads-spyware?ref=agarhouse.com)