APEP BAR | SURVEILLANCE — October 16, 2026. Imagine seeing an ordinary advertisement, ignoring it completely, and still having your device targeted. No suspicious link. No mysterious attachment. Not even a click. According to new research, the online advertising system was used as a delivery route for mercenary spyware.
On October 15, the University of Toronto’s Citizen Lab published an investigation titled Exposing AdFection. Researchers connected the Israeli advertising company Discover-Tech to a system that they say enabled surveillance operators to identify devices through advertising data and deliver malicious code when an ad was rendered.
The invisible auction behind an ordinary page
Much of the internet’s advertising happens through real-time bidding. When a page or app opens, software may solicit offers for an ad placement, using information about the device and its user. The ad itself can carry code. Citizen Lab says the infrastructure it studied could connect ad-delivery tools with spyware targeting systems.
The researchers examined attacks involving devices at international broadcaster Al Jazeera in 2024 and 2025. Their technical findings link the targeted ad route to spyware associated with Candiru, now called Integrity Labs. Citizen Lab says at least 45 devices at Al Jazeera were targeted during those operations, and describes supporting network traces and malware analysis.
Tracking millions is not the same as infecting millions
The report also describes billions of advertising bid records and extensive profiling across websites and apps. That scale matters, but it is essential not to confuse exposure to tracking infrastructure with confirmed spyware infection. The researchers established particular infection cases; they did not demonstrate that every device shown an associated ad was hacked.
Citizen Lab says Google, IAB Europe and several other advertising vendors took action to cut off Discover-Tech’s access following disclosures. The company’s perspective and responses, where available, should be read alongside the researchers’ allegations and technical evidence.
The power question
Digital advertising was designed to sell attention. If the same machinery can precisely locate a target and deliver a cyberattack, the line between commercial profiling and intelligence operations becomes alarmingly thin.
The Apep question: When an invisible marketplace can decide who sees what on a screen, who is accountable for what runs behind the screen?
Sources
Featured photo: Jonas Leupe / Unsplash. Illustrative smartphone photograph; no depicted person is alleged to be involved.
