Overview
The intersection of programmatic advertising, user profiling, and mercenary spyware — where ad brokers can deanonymize audiences at scale and selectively deliver zero-click exploits through normal ad impressions.
Timeline
- 2026-10-15: Citizen Lab documents adfection — first public technical proof of zero-click mercenary spyware via targeted ads, centered on discover-tech and candiru (2026-10-15-targeted-ads-0-click-mercenary-malware)
Key Players
- citizen-lab
- discover-tech
- candiru
- Major ad platforms (Google cited for policy enforcement removals)
Analysis
The campaign reframes ad-tech supply chains as a journalistic and activist threat model: newsroom devices can be compromised without phishing links if ad targeting aligns with spyware customers. Defensive guidance in primary reporting emphasizes network monitoring, segregated devices for sensitive work, and scrutiny of in-app ad SDKs — not just email security.
Confiant and Citizen Lab both studied Discover-Tech; Candiru-linked ad volume was a small fraction of overall impressions per Confiant/Reuters.