Basis: Citizen Lab’s October 15, 2026 report, as covered by PPC Land, which found that ads bought through a vendor Google had listed since 2020 delivered Candiru spyware to at least 45 devices; and the invalid-traffic debate around Augustine Fou’s critique of a $63 billion estimate. This is not security advice.
Buyers and partners
- How does each exchange or SSP verify new buyers, and how often is that checked again?
- Do you receive logs that show who bought which impressions?
- How quickly can a buyer be paused, and who can pause it?
Supply and quality
- Which verification vendors measure invalid traffic, and are rates based on clicks or impressions?
- Do you review app and site lists, including long-tail supply?
Response
- What is the process if a partner is named in a security report?
- Who is contacted, and what evidence do you keep?