A Citizen Lab investigation published October 15, 2026, says digital ads associated with Israeli-based Discover-Tech could be used to deliver spyware to selected devices without requiring a user to click. Researchers identified 45 devices belonging to Al Jazeera that they said were targeted between 2024 and 2025. The findings are researchers’ conclusions and have not been independently adjudicated.
How the alleged ad-based delivery worked
Citizen Lab says its technical analysis found that Discover-Tech-associated ads could transmit device and advertising identifiers to company servers. For selected targets, the servers could then return JavaScript that researchers say could enable an infection without a click. The lab calls the method “AdFection.”
The researchers linked the advertising infrastructure to spyware attributed to Candiru, also known as Integrity Labs. WIRED and German public broadcaster BR/tagesschau reported on the investigation on the same day it was published. Their accounts support the report’s substance, but draw substantially on the same underlying research rather than providing separate forensic confirmation.
The claimed technique matters because it uses ordinary advertising infrastructure as a potential route to spyware, rather than relying on a malicious link that a target must open. Citizen Lab also says the system could be used to profile users and deanonymize them. Those capabilities are the lab’s assessment of the technology, not evidence that every person exposed to an ad was identified or infected.
Al Jazeera devices were targets, researchers say
Citizen Lab says it identified 45 devices belonging to Al Jazeera that were targeted during 2024 and 2025. WIRED reported that Al Jazeera shared device logs with the researchers. The dossier does not establish that all 45 devices were successfully infected, so the target count should not be treated as a confirmed infection count.
BR/tagesschau reported that researchers demonstrated successful infections among at least 45 devices, while the supplied evidence also cautions that “targeted” and “confirmed infected” are distinct findings. WIRED said Al Jazeera did not respond to its request for comment. The available information therefore supports describing the devices as targets while attributing any claim of successful infection to the researchers.
Broad ad reach does not mean broad infection
Citizen Lab says Discover-Tech-related ads appeared across nearly 200,000 apps and websites in its collected data. WIRED gives a more specific breakdown: more than 70,000 mobile apps and 120,000 websites during March through June 2026. The researchers also identified ad impressions on government and critical-infrastructure networks.
Those figures describe the reach of ads and recorded impressions, not the number of infected devices. An impression may indicate exposure or a profiling opportunity, but does not by itself show that spyware was installed. The researchers do not claim that every ad was malicious or that every device connected to the networks was compromised.
That distinction is central to understanding the investigation. The report presents a possible delivery mechanism and evidence of targeted devices, while the scale figures show where related advertising appeared. They do not establish how many people were infected across the wider population reached by the ads.
Ad companies took action
Citizen Lab reports that Google and IAB Europe removed Discover-Tech from their vendor lists in early October 2026, and that Google ended the company’s access to its ad exchange. The lab also reports actions by Beeswax, Vungle/Liftoff and Eskimi. WIRED separately obtained statements from Google, IAB Europe and Beeswax confirming action against Discover-Tech.
The reported removals and access restrictions are responses to the company’s advertising activity, not proof that all past exposure has been identified or that any remaining risk has ended. The evidence describes actions reported as of October 15, 2026, and does not establish the longer-term effects of those steps.
Citizen Lab characterizes its work as a technical demonstration of mercenary spyware delivery through targeted advertising. That characterization should remain attributed to the researchers. The findings describe a route that could be used against selected targets, but do not show that all Discover-Tech ads were used for spyware or that all users exposed to them were infected.