The Advert Was The Attack. The Vendor Was On The Approved List.

On Thursday 15 October 2026 the Citizen Lab at the University of Toronto published research it describes as the first public technical confirmation of something the advertising industry has been warned about for years: mercenary spyware delivered through ordinary targeted adverts, with no click, no attachment and nothing for a user to get wrong. At least 45 devices at Al Jazeera were attacked this way across 2024 and 2025. The finding that should hold a board's attention is not the spyware. It is that the company acting as the delivery channel sat on Google's and IAB Europe's approved vendor registries for six years, and operated inside the consent framework built to make advert tracking lawful.

Most spyware research ends with advice for a small number of exposed individuals, and that is a reasonable place for it to end. This one does not stay there. The mechanism is the real-time bidding system that serves adverts to practically every browser and mobile application in commercial use, so the population that could be reached is not a list of journalists and dissidents. Citizen Lab reports identifying advert impressions inside the networks of the European Parliament, the European Commission and the Council of the European Union, and inside NATO and United Nations networks. It is careful about what that does and does not mean. So are we, and the distinction is in the confidence note at the end.

What happened

Citizen Lab names the technique AdFection and names the company at its centre as Discover-Tech, an Israeli advertising technology firm registered in 2020 that runs a profiling and targeting platform called Controlium and an advert platform called MyDSP. Its public presentation is that of a legitimate advertising business. Citizen Lab's assessment, reported by The Register, is that it "appears to be a front for large-scale ad espionage abuse".

The mechanism is worth following, because its design is the reason it went unnoticed. A Discover-Tech advert carries a script tag pointing at what the report calls a NOAS server. When the advert renders, that server receives the advertising identifiers attached to the request, decides whether the device belongs to someone the customer wants, and responds accordingly. An eligible device is sent JavaScript. Everyone else is sent a zero-byte response and sees an ordinary advert. Discover-Tech never hands malicious code, or a pointer to it, to the advert vendors carrying its traffic, which is precisely why those vendors had nothing to find.

The spyware delivered through this path is attributed to Candiru, an Israeli vendor now operating as Integrity Labs, which Citizen Lab links to the Al Jazeera chain with high confidence on the basis of a Windows implant, its persistence method and its command and control infrastructure. Discover-Tech was not serving one customer. A second zero-click vendor, Bindecy, used the same platform, and a separate actor the report calls DARK CARTOGRAPHER ran mass de-anonymisation across more than thirty countries from the same infrastructure.

• August 2022 to July 2026The period over which Citizen Lab observed the Candiru validator fingerprint, retired through May and June 2026.
• 2024 and 2025The Al Jazeera attacks. At least 45 devices were targeted, established from network logs that Al Jazeera itself provided to the researchers.
• April 2025 to December 2025Candiru-linked domains served through Discover-Tech adverts, reaching an estimated hundreds of thousands to millions of users.
• January to June 2026Newer NOAS infrastructure in operation. At a single server, 3,637,213 devices were marked eligible.
• March to June 2026The bidding data analysed: 3,770,286,576 bids, 441,954,291 of them won, roughly 718.7 million carrying the attacker's script tag, geolocated to 161 countries.
• August 2026Discover-Tech's analytics instances, the source of those records, were shut down.
• Early October 2026Google terminated Discover-Tech's access to its advertising exchanges and removed it from its vendor registries, and IAB Europe removed it from its global vendor list. Beeswax, Liftoff and Eskimi each cut or paused access.
• Thursday 15 October 2026The report is published, timed alongside a parallel investigation by the advert quality firm Confiant.

The delivery chain in four steps. The reason six years of vendor vetting found nothing is card 04: the advert vendors carrying the traffic were never given the malicious code or a pointer to it.

Why this one is different

Three things separate this from the ordinary run of spyware disclosures, and none of them is the implant.

The first is that there is no user action to train out of. Awareness programmes rest on an assumption that holds for most of what arrives: somebody has to open, click or approve something, so teaching them not to is a real control with measurable effect. Here the advert renders because the page loaded. There is no decision point and no behaviour to correct. An organisation with a mature phishing programme and a well-drilled workforce had the same exposure as one with neither.

The second is that nobody procured the supplier. Third-party risk management assumes a contract somewhere: a vendor was selected, assessed, questioned and signed, so there is a relationship to govern and a register to put it on. Nobody affected by this bought anything from Discover-Tech. It reached their devices because staff loaded advert-supported pages, and the slot was filled in a few hundred milliseconds by an automated auction involving parties nobody named and nobody approved. Assurance built around procurement cannot see a supply chain that arrives without being bought.

The third is the approved vendor list, and this is the one we would put in front of a board. Discover-Tech was carried on Google's vendor registry and IAB Europe's global vendor list from 2020 until October 2026. It registered under the consent framework the European advertising industry built so that advert tracking could meet data protection requirements. For six years, an organisation checking whether this participant in its advert supply chain was legitimate would have found it listed, certified and compliant. The list was accurate about what it measured. It simply never measured this.

The central finding, and the caveat that governs it. An approved vendor list measures whether a company completed the process to participate. It was never a measure of whether that company was safe.

There is a prior warning here that is uncomfortable to read in hindsight. In June 2019 the Information Commissioner's Office published its Update report into adtech and real time bidding, which found that profiles created about individuals are "extremely detailed" and are "repeatedly shared among hundreds of organisations for any one bid request", and judged that profiling "disproportionate, intrusive and unfair". The ICO's concern at the time was commercial misuse of personal data. What AdFection demonstrates is the same structural fact with a different consequence: when a bid request is broadcast to hundreds of parties, the identity and intent of every one of those parties is part of your risk position, and almost no organisation has ever enumerated them.

What the institutional findings do and do not establish

This section exists because the most quotable part of the research is also the part most likely to be overstated, including by people selling security services.

Citizen Lab states that it identified advert impressions in NATO and United Nations networks, and in Europe from the networks of the European Parliament, the European Commission and the Council of the European Union's General Secretariat. Separately, Confiant's parallel work found signs that these adverts were displayed on networks of major governmental entities including the United States Department of Defense, the International Atomic Energy Agency and the International Criminal Court.

The report attaches a caveat that should travel with every one of those names: "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware." The Register reports that Citizen Lab found no evidence those organisations were infected, while noting the adverts could have been used to profile devices on their networks. Profiling is the realistic concern, and it is serious enough on its own. A platform that can establish which devices sit on a named institutional network, and fingerprint them, has produced targeting intelligence whether or not an implant was ever delivered. No figure has been published for how many impressions led anywhere, and nobody should imply one.

One further boundary. No UK organisation is named anywhere in this research, and as at 7 November 2026 no UK or EU regulator has commented on it, opened an inquiry or taken any action, on the searches we have been able to run. Citizen Lab has asked regulators to investigate. That request is not a regulatory position, and the gap between the two is where a good deal of vendor commentary has been spent since.

The commercial exposure for UK organisations

Regulatory. There is no new obligation here, and anyone telling you otherwise is selling something. The existing ones still reach it. If a device on your network were compromised through this path and personal data were accessed, the UK GDPR Article 33 duty to notify the ICO without undue delay and no later than 72 hours after becoming aware applies exactly as it would after any other intrusion. For organisations in scope of NIS2 through an EU entity, the Article 23 clock starts at awareness of a significant incident rather than at certainty, with an early warning due within 24 hours. The harder problem sits before notification. Both duties begin with becoming aware, and a channel that leaves no email, no download and no user report is specifically difficult to become aware of.

Financial. The cost is investigative rather than remedial, and it is incurred whether or not anything happened. Answering "were our devices served these adverts" requires outbound web and DNS records covering March to June 2026, retained, searchable and matched against published indicators. An organisation keeping ninety days of proxy logs cannot answer it at all. That is not a breach. It is an inability to rule one out, which is a materially worse position in front of an insurer, an acquirer or a customer's assurance team.

Contractual. Supplier assurance questionnaires do not ask about this, in either direction. Nobody will ask you to attest to your advert filtering posture, and you will not think to ask it of a supplier who processes your data on a machine that also browses the web. For organisations whose own websites carry advertising or third-party tags, there is a sharper version of the same question: your consent management platform documents which vendors you permit, and that document is now also a list of parties whose conduct you have implicitly represented to your users as acceptable.

Governance. This exposure has no natural owner. The advertising relationship belongs to marketing, the consent framework to legal or privacy, the browser to end-user computing, and the consequence lands on security. Each function is doing its job correctly, and the gap between them is where the whole of this sits. That is an organisational design finding rather than a technical one, which is why it will outlast the infrastructure Citizen Lab shut the lights on.

What leaders should do now

1. Decide whether advert filtering and identifier hygiene are security controls. In most organisations network-level advert blocking is treated as a bandwidth or productivity measure, deployed inconsistently and owned by nobody in particular. Citizen Lab's own advice to people who may be targeted is to disable advert tracking or block adverts altogether. Reclassify both, give them an owner, and apply them to managed devices as policy rather than as a browser extension somebody installs by choice. The targeting in this campaign depended on identifiers passed in the bid request, so resetting and limiting advert identifiers through device management is not a privacy nicety here. It degrades the attacker's ability to select a target, and it is probably absent from your hardening standard today.

2. Name the twenty most exposed people and give them a different browsing path. Not the twenty most senior. The ones whose compromise would be most useful to somebody: legal and corporate development during a transaction, anyone handling regulatory or litigation matters, research staff, and anyone working on a politically sensitive brief. Browser isolation or a separate device for general browsing is modest work for a population that size, and it is the only control here that defeats the technique rather than shortening the odds.

3. Establish now whether you could answer the question. Ask your security team one thing: if indicators were published tomorrow for a channel we never bought, could we determine whether our devices touched it between March and June 2026? The answer is about retention and searchability of egress records. If it is no, that is worth knowing in a meeting rather than during an incident, and the fix is a retention decision with a price attached.

4. Add the uncontracted third party to the risk register. One line, written honestly: the organisation is exposed to parties in the advertising supply chain that it has not selected, cannot enumerate and does not contract with. Naming an unmanaged risk is not an admission of failure. It is the precondition for anybody deciding what to do about it.

5. Do not wait for a regulator to make this real. No UK or EU authority has acted on this research. If one does, the decisions above will have to be taken under time pressure and in public. They are cheaper taken now, and they are defensible either way.

Five decisions, not five tasks. Only the second defeats the technique outright. The other four decide whether the organisation could tell if it had been reached.

Three questions for the board

1. If indicators were published tomorrow for a channel we never bought, could we tell whether our devices touched it? This is a retention and logging question wearing a threat intelligence costume, and it generalises well beyond adverts. Ask it about any third-party code that executes on your endpoints.

2. Who owns the browsing path for our most exposed people, and what is actually different about it? If the answer is that they use the same browser, the same filtering and the same device as everybody else, then seniority and sensitivity are carrying no protective weight at all.

3. Our consent framework was built to make marketing lawful. Who has ever assessed what it exposes? The honest answer in most organisations is nobody, because the framework was scoped as a compliance artefact rather than a security one.

Strategic takeaway

The durable lesson is about the approved vendor list, and it is not confined to advertising. Discover-Tech passed Google's vetting and IAB Europe's registration for six years while, on Citizen Lab's account, acting as a bridge into the mercenary spyware market. The vetting was not negligent. It answered a narrow question, whether a vendor had completed the process required to participate, and that was never a proxy for whether the vendor was safe to let near a browser. Every assurance regime that reduces to a membership check carries the same defect, from certification schemes and marketplace approvals to the supplier questionnaire that asks whether a company holds a certificate rather than what it does with the access it is given.

The second lesson is about where the delivery surface has moved. For a decade the route worth defending was electronic mail, and the industry built well around it: gateways, sandboxing, awareness programmes, reporting buttons. The browser got a different kind of attention, mostly patching and category filtering, on an assumption that the user chooses what to visit and can be taught to choose better. Real-time bidding breaks that assumption. On an advert-supported page, much of what executes was selected by an auction, in milliseconds, from a pool of participants the user never saw and the organisation never approved. That is a supply chain by any reasonable definition, and it is governed by almost nobody.

Neither point requires a new budget line. Both require somebody senior to decide that an unowned risk is now owned, which is the part that tends not to happen until a researcher in Toronto publishes four billion bidding records.

Confidence note

Confirmed by the research, as its own stated findings. That Citizen Lab published the AdFection research on 15 October 2026 and describes it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. The mechanism: a script tag in a Discover-Tech advert pointing at a NOAS server, which receives advertising identifiers on render, returns JavaScript to eligible devices and a zero-byte response otherwise, and the statement that Discover-Tech never directly shares malicious code or pointers to it with the advert vendors. Discover-Tech as an Israeli firm registered in 2020 operating the Controlium and MyDSP platforms. The attribution of the Al Jazeera chain to Candiru, now Integrity Labs, at high confidence, and the Windows implant, persistence method and infrastructure on which that rests. At least 45 Al Jazeera devices targeted across 2024 and 2025, established from network logs Al Jazeera provided. Bindecy as a second zero-click vendor on the platform and Intelos as a linked advertising intelligence firm. DARK CARTOGRAPHER as a separate actor conducting mass de-anonymisation across more than thirty countries with infrastructure links to an unnamed United States government contractor. The figures: 3,770,286,576 bids analysed March to June 2026, 441,954,291 won, roughly 718.7 million carrying NOAS script tags, adverts displayed in 75,373 applications and 120,768 websites, bids geolocated to 161 countries, and 3,637,213 devices marked eligible at one server between January and June 2026. Upstream bid share dominated by Yandex at 67.4% and Google Ad Manager at 24.74%. Registration on Google's and IAB Europe's vendor registries from 2020 to 2026 and use of the European consent framework. The impressions identified in NATO and United Nations networks and in the networks of the European Parliament, the European Commission and the Council of the European Union's General Secretariat. Confiant's separate finding of signs that the adverts were displayed on networks including the United States Department of Defense, the International Atomic Energy Agency and the International Criminal Court. The remediation steps by Google, IAB Europe, Beeswax, Liftoff and Eskimi in early October 2026, that Xandr did not respond within the timeline given, and that Citizen Lab wrote to thirteen companies of which Bindecy and Intelos did not respond. The call for regulators to investigate.

Quoted, and load-bearing. The caveat "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware" is quoted from the report and governs every institutional name above. The ICO quotations are taken from the published text of its Update report into adtech and real time bidding of 20 June 2019: that profiles are "extremely detailed", that they are "repeatedly shared among hundreds of organisations for any one bid request", and that the profiling is "disproportionate, intrusive and unfair".

Reported, and not read from the research itself. That Citizen Lab found no evidence the government, defence and NATO organisations were infected, and its observation that the adverts could have been used to profile devices on those networks, from The Register. The characterisation that Discover-Tech "appears to be a front for large-scale ad espionage abuse", also from The Register. That login records for the Controlium dashboard were exposed, including records for at least two Candiru employees, from TechCrunch, which also reports that Al Jazeera did not respond to a request for comment. That Discover-Tech has facilitated mercenary spyware since at least 2024, and that DARK CARTOGRAPHER's activity dates to 2019, from CyberScoop. That Discover-Tech and Candiru did not respond to approaches from The Register.

Not established. Whether any of the institutional impressions resulted in an infection, or in targeting, on any network. How many of the 45 Al Jazeera devices were successfully compromised rather than attacked: the research describes devices targeted in zero-click attacks and outlets differ on how far that went, with TechCrunch reporting them as apparently hacked and CyberScoop as targeted. Which governments were the customers. Whether any UK organisation was affected, since none is named. Whether any regulator will act. The report itself records open questions, including how the Controlium platform uses one of the identifiers it collects and the purpose of the company's tracking pixel, and that it could not access corporate registration records for one shareholder. We have not named the individuals the research associates with the companies involved, because nothing in the commercial argument depends on it.

Assessed, and labelled as ours. The reading of this as a procurement and assurance finding rather than a spyware story. The argument that an approved vendor list measures participation rather than safety, and that the same defect runs through certification schemes and supplier questionnaires. The read across from the ICO's 2019 report, which is our juxtaposition and not a position the ICO has taken on this research. The judgement that device profiling, rather than infection, is the realistic institutional concern. The six actions, the three board questions and the characterisation of this as an unowned risk. The statement that no UK or EU regulator has commented reflects searches conducted on 15 October 2026 and repeated on 7 November 2026, and absence of a published statement is not proof that none exists. None of the analysis in this briefing is the stated position of Citizen Lab, Confiant, the ICO, the NCSC or any other authority, and it should not be read as such.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification and specialist technology recruitment as one integrated capability for organisations in the UK, EU and Americas.