- Date
- October 15, 2026
- Kind
- Industry development
- Significance
- High
A Citizen Lab report dated October 15, 2026 concluded with high confidence that targeted ads bought by Israeli firm Discover-Tech delivered Candiru spyware, without any clicks, to at least 45 devices belonging to Al Jazeera staff. Citizen Lab calls the technique “AdFection” and describes it as “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads”.
The numbers
- Between March and June 2026 the vendor bid on 3.77 billion impressions and won 441.95 million, in 75,373 apps and 120,768 websites, reaching targets in 161 countries, for about $109,091.
- Google listed the vendor from 2020 and cut its access in early October; Vungle, part of Liftoff, paused it; IAB Europe registered it as vendor 778 in 2020.
Not stated
The Candiru attribution is a research finding, not a legal one, and PPC Land could not confirm IAB Europe’s October 8 removal of the vendor.
Why it matters
This is our analysis. If a buyer can reach a named person, an exploit can be delivered the same way, so vendor vetting in ad tech is a security control.
What happened next
Platforms have paused or removed the vendor. No rule change on buyer verification has been announced.