The Ad Slot Had a Second Customer: Spyware.

What if the dangerous click never happened?

Citizen Lab’s October 15, 2026 report describes AdFection: mercenary spyware delivered when a targeted advertisement renders, without a click. Researchers identify Discover-Tech as the advertising intermediary and call this the first public technical confirmation of that delivery method.^[1]

So much for telling every mark to stop pressing suspicious buttons. This is a rather different problem, droogies: the button is optional.

Forty-five what, exactly?

The primary report says at least 45 devices within Al Jazeera were targeted in 2024–2025. It separately documents infections, using network logs and an implant recovered from a compromised device, and attributes the spyware to Candiru with high confidence. That is not a count of 45 individual journalists, nor a new attack dated October 15.^[1]

How big was the advertising footprint?

Researchers analysed almost four billion bidding records and found Discover-Tech ads across nearly 200,000 websites and mobile apps. Those are advertising-reach figures, not an infection census. Citizen Lab also reports that Google, IAB Europe and several ad vendors cut or restricted Discover-Tech’s access after disclosure.^[1]

Reuters reported that Discover-Tech did not return its messages and that attempts to reach Candiru’s owners were unsuccessful. Its reporting also records Google’s policy-violation explanation and IAB Europe’s suspension following an audit.^[2]

Who owns the security bill?

The uncomfortable editorial point is not that every publisher knowingly joined a spy operation. It is that an advertising chain can become a security boundary while still being managed like a sales channel. A familiar-looking advert is not a security certificate.

Keep the claims straight: documented spyware delivery is serious enough. Inflating every ad impression into a hacked victim only gives the accountability department somewhere convenient to hide.