Developing
The Candiru attribution is a research finding, not a legal one; PPC Land could not confirm IAB Europe's removal of the vendor.
In 60 seconds
- Citizen Lab concluded with high confidence that Discover-Tech's targeted ads delivered Candiru spyware, without clicks, to at least 45 devices belonging to Al Jazeera staff.
- Between March and June 2026 the vendor bid on 3.77 billion impressions and won 441.95 million; its ads ran in 75,373 apps and 120,768 websites.
- Spend was about $109,091. Google had listed the vendor since 2020 and cut its access in early October; Vungle paused it.
- Citizen Lab calls the technique "AdFection", the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
Impact Layer
- What changed
- Programmatic buying has been shown, in a published investigation, as a delivery route for state-grade spyware.
- Why it matters
- Targeted ads can reach named individuals, so vendor vetting and inventory controls become security matters, not only brand-safety ones.
- Who is affected
- DSPs, SSPs, ad exchanges and security teams, and organisations whose staff are at risk of targeting.
- Martech stack area
- Advertising, Data
- Stack impact
- Ask your DSP and exchanges how they vet buyers and what log evidence they keep, and review which vendors hold access to your supply.
- Business impact
- High Based on PPC Land's reading of a Citizen Lab report. Attribution to Candiru is a research finding, and PPC Land could not confirm IAB Europe's removal of the vendor.
- Related technologies
- Related vendors
- What to watch
- Further vendor removals and any platform rules on buyer verification.
PPC Land’s October 19, 2026 edition leads with a Citizen Lab report dated October 15 on spyware delivered through advertising.
What Citizen Lab found
- With high confidence, targeted ads bought by Israeli firm Discover-Tech delivered Candiru spyware to at least 45 devices belonging to Al Jazeera staff, without any clicks.
- Citizen Lab calls the technique “AdFection” and describes it as “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads”.
- Between March and June 2026 the vendor bid on 3.77 billion impressions and won 441.95 million. Its ads ran in 75,373 apps and 120,768 websites, reaching targets in 161 countries. Spend was about $109,091.
Platform responses
Google listed the vendor from 2020 and cut its access in early October. IAB Europe registered it as vendor 778 in 2020. Vungle, part of Liftoff, paused the company, and Eskimi said “a few hundred dollars” passed through it.
Not stated
The Candiru attribution is a research finding, not a legal one. PPC Land could not confirm IAB Europe’s October 8 removal.
Our read
A buyer that can target a named person can also deliver an exploit. Treat supply-chain vetting as a security control.
Sources
- PPC Land: Targeted ads delivered spyware to 45 devices through a vendor Google listed (opens in a new tab)
Source for the report's findings, figures and the platform responses.