On 15 October 2026, Citizen Lab (a research group at the University of Toronto that studies spyware and surveillance) published a report with Confiant (a company that inspects online ads for malicious code). Their name for the method is AdFection (delivering mercenary spyware through an advertisement the page merely shows). The sentence that will travel farther than the report is “an ad installed spyware, and nobody had to click.” Read the nouns. The confirmed infections are at least 45 Windows computers at the Al Jazeera newsroom, in 2024 and 2025. They are not a billion phones this morning. An impression (one time an ad was shown) is not an infection (a program that stayed on the machine and took data). I am treating the report as the careful sentence, and the short headline as the sentence to unlearn.
a page is a program, before it is a picture
A browser (the app that fetches an address and shows you the result: Chrome, Safari, Firefox, or the small browser hidden inside another app) does not receive a photograph of a page. It receives instructions. HTML (the tags that say where a paragraph goes, and where a box goes) is the layout. CSS (the rules for color, size, and position) is the paint. JavaScript (a programming language the browser will run because the page asked it to) is the behavior. Together they are a program. You experience a picture. The computer experiences a to-do list.
A click (a press you choose, on a link or a button) is one event in that program, and it is late. By the time your finger is a choice, the page has already fetched files, run scripts, and drawn boxes. Render (the moment the browser draws something, which includes running the code that belongs to that something) happens whether or not you ever touch it. That order is the whole trick. “I didn’t click the ad” is a true sentence about your finger. It is not a sentence about what the page ran.
an ad is a guest program
An advertisement on a page is not a rectangle the publisher drew by hand. A publisher (the site or app that owns the empty box) leaves a hole. Into that hole, someone else’s code is invited. The invitation is the ad tag (a snippet that says “ask the ad system what to put here”). When the hole is filled, the guest can draw a picture, measure that you saw it, and run more code. A picture cannot ask a server a question. Code can.
Zero-click (an attack that does not need you to tap a link, open a file, or press the ad) is a description of that order. It is not a description of magic, and it is not a description of a mind. The page still ran something. You just were not the one who decided to run it. The older advice, “don’t click strange ads,” assumes the dangerous moment is the click. For this class of attack the dangerous moment is the render. Not clicking does not put the guest back outside.
the auction, in the order it actually happens
Before a rectangle appears, a sale happens, and it happens in the time of a blink. Real-time bidding (an auction for one single ad slot, run while the page is loading, not a sale you sit through) is the market. The pieces have names. The names are the prerequisites, so here they are before the story uses them.
A bid request (a message that says “someone just opened this page, here is what we know about the device, who wants this slot”) leaves the publisher’s side. An SSP (supply-side platform: the publisher’s agent in the auction, the one offering the slot) sends that request out. A DSP (demand-side platform: an advertiser’s agent, the one deciding whether to buy this one viewing) answers with a price. The winner’s creative (the actual ad: the file, or the script, that will fill the hole) is what the page then loads. An impression (a counted viewing: the ad was delivered to be shown) is the receipt for that sale. It is not a receipt for a hack.
Citizen Lab’s own opening is the same shape. Each time you see a targeted ad, it is usually the result of a winning bid in a split-second auction, the kind hosted by companies like Google, designed to reach and profile specific people. Targeting (choosing which devices are worth bidding on) uses identifiers the ad world already has. An IP address (the number your network shows to the rest of the internet) is one. A cookie (a small note a site stored in the browser, so the next visit is recognized) is another. A mobile advertising ID (a number the phone’s operating system hands to apps, so ads can recognize the phone without being told your name) is a third. Citizen Lab says Discover-Tech’s system can select a device for profiling or for infection using those kinds of handles. Selection is a list. A list is not yet a broken computer.
what the server usually does, and what it sometimes does
Discover-Tech (an Israeli company that presents itself as an ordinary advertising firm, and that Citizen Lab describes as a bridge between ad networks and mercenary spyware makers) is the DSP in this story. Candiru (an Israeli spyware company, blacklisted by the United States government, also reported under the later name Integrity Labs) is the maker whose program was confirmed on the Al Jazeera machines. Bindecy (another spyware maker the researchers name as a user of the same bridge) is part of the same pattern, not a second counted outbreak. Discover-Tech is not, on the report’s wording, the author of the spyware. It is the company that could buy the slot and decide what code came back.
The report’s own sequence, with the figure reference left out: Discover-Tech wins a bid, and one of their ads is pushed to a website or app that is open on a device. The user may see the ad. In some cases it may render in the background. When the site or app receives the ad, it renders it, requesting JavaScript from a Discover-Tech server embedded within the ad. In most cases, the person who sees the ad is not selected, and the server will not return any JavaScript to be executed. The ad can still gather data, including cookies and the device’s public IPv6 address (the newer, longer form of an IP address), and send that data back.
Sit with the branch. Two devices can be shown rectangles that look alike. One gets an empty answer and a measurement. The other gets a script. “I saw their ad” and “their script ran on my machine” are different events. The report says the first is the common one.
Spyware (a program that stays on a device and reports what is on it to someone the owner did not invite) is a later stage than a script that merely loaded. A mercenary spyware vendor (a company that sells that kind of break-in to governments, rather than a person posting a trick) is what Candiru is. Getting from “a script ran in an ad box” to “a program is now living outside the browser and reading the disk” still requires a hole in the browser or in the operating system. A browser sandbox (the fence that is supposed to keep a page’s code away from your files) is that fence. A bug (a mistake in the fence) is how a guest steps over it. Citizen Lab is not, in the sentences this post relies on, handing the public a fresh CVE (a public ID number for one specific bug, so you can check whether your version is patched) to type into a search box tonight. The delivery truck is the ad. The lockpick is still a bug. This post does not describe the lockpick, the server names, or the samples. Those do not help you understand the auction.
the number that is an infection, and the numbers that are not
The infection count to keep is the small one. Citizen Lab says, with high confidence, that devices at Al Jazeera were targeted and infected with Candiru’s spyware using this method. Reuters, citing the researchers, puts it at 45 Windows devices between 2024 and 2025, confirmed because the newsroom shared network logs (records of which computers talked to which addresses, and when). TechCrunch’s account is the same shape: at least 45 Windows computers. Bloomberg says dozens of computers and names 45 devices. I am not averaging those into a bigger number. Forty-five confirmed machines at one newsroom, over two years, is the infection sentence. Reuters also says Al Jazeera did not return messages seeking comment. Silence is not a confirmation and it is not a denial. The logs are the confirmation the researchers claim.
The big numbers are about the market, and the report refuses to let you slide them into the infection sentence. Citizen Lab says Discover-Tech’s MyDSP (the name of its demand-side platform) bid on 3,770,286,576 impressions and appeared to win 441,954,291 of them, 11.7 percent, across March through June 2026. Then the sentence that should sit on top of that arithmetic, in their words: “A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.”
Four hundred forty-two million wins is four hundred forty-two million times a rectangle was bought. It is not four hundred forty-two million break-ins. Dividing wins by bids gives the 11.7 percent they printed. Dividing wins by the 45 confirmed machines gives a nonsense ratio, because those are different kinds of objects. Do not do that division and call it a rate of infection.
Reuters adds the map of where the ads could appear: more than 120,000 websites and 75,000 apps. Confiant, quoted by Reuters, says the ads very likely touched hundreds of millions of people. “Touched,” in that sentence, means the ad was in a position to be shown. Citizen Lab says the ads were displayed in apps including Duolingo, dating apps, period trackers, German weather apps, Yahoo Mail, Viber, and Truecaller. Displayed inside an app is not “that app’s company was in on it.” It is not “users of that app were infected.” It is reach. A popular app is a crowded sidewalk. Buying a sign on a crowded sidewalk is not the same as picking every pedestrian’s pocket.
The same care applies to the institutional names. Reuters says Citizen Lab had evidence the ads were shown to people on networks of the United Nations, NATO, the European Commission, and more than a dozen other governments, and that Confiant described ads shown inside networks including the Pentagon, the IAEA (the International Atomic Energy Agency), and the ICC (the International Criminal Court), plus some chip firms and unnamed newsrooms. Shown on a network means a device using that network loaded the ad. Bid requests say where a device is. That is the ad system working as designed. It is not a list of hacked ministries.
| Sentence you may hear | What the 15 October reports support |
|---|---|
| An ad hacked everyone who saw it | An impression is not an infection. Most checks return no script |
| 442 million machines were taken over | 441,954,291 is the count of auction wins in four months |
| 45 is a sample of a billion infections | 45 is the confirmed Al Jazeera Windows count, 2024 to 2025, from logs |
| Google wrote the spyware | Google and others ran auctions Discover-Tech could bid in. Google then kicked the firm off its ad platforms |
| Duolingo users were the target list | Ads were displayed inside popular apps. That is reach, not a victim list |
| Don’t click and you are safe | Zero-click means the script can run at render time. The finger is the wrong lever |
| The UN was hacked | Ads were shown on devices using those networks. Shown is not compromised |
a guest list is not an uninstaller
Early October 2026, before the report was public, Google and IAB Europe (an advertising-industry body that keeps a list of vendors allowed to handle ad data in Europe) acted. Citizen Lab says both removed Discover-Tech from their ad vendor registries. Reuters is slightly more precise about the verbs: Google kicked the firm off its ad platforms, and IAB Europe suspended its status. A registry (a guest list of companies allowed to buy or handle ads) is a door policy. Closing it changes who can bid tomorrow. It does not delete a program that already stayed on a machine in 2024. A guest list is not an uninstaller (a tool that removes a program that is already there).
A journalist is a person a government might want to read over the shoulder. Mercenary spyware has a long record of being aimed at reporters, and the confirmed case here is a newsroom, not a random living room. That is a reason for newsrooms to care this week. It is also a reason for everyone else not to confuse “this pipeline can aim” with “it already aimed at me.”
Windows (Microsoft’s desktop operating system, the kind of computer named in the Al Jazeera confirmation) is the machine in the counted infections. Phones are in the wider story because ads also run inside phone apps, and because a mobile advertising ID is one handle used to pick a device. I am not promoting the phone half into a second confirmed infection count. The report’s summary talks about profiling millions of devices, and about infection of selected targets. The counted infections I will repeat are the 45 Windows machines.
what to actually do, split by who you are
If you are reading this on a phone that is not used for sensitive reporting, the honest action is boring. Keep the operating system and the browser updated, because the jump from an ad’s script to a lasting program still needs a bug, and vendors do patch bugs. An ad blocker (a tool that refuses to load many ad tags in the browser) reduces how often a guest script is invited onto a website. It does less inside apps that draw their own ads, because those ads never pass through the browser extension. Do not read “hundreds of millions” as “buy a new phone tonight.” Citizen Lab’s sentence for people at elevated risk (people who may be targeted because of who they are or what they do) is to get expert help, not to follow a blog checklist and feel finished.
If you run a newsroom, or any place that keeps sources, the report is more direct. Citizen Lab urges news organizations to get expert assistance, and to review their security posture and their logs for signs of this kind of targeting. A log review means looking for computers that talked to addresses they should not have, around the time an ad loaded. That is a job for someone who already knows that network. It is not a job a paragraph can finish for you.
If you publish a site or an app and you sell the hole, you are closer to the mechanism than a reader is. Your page invited the guest. You often do not see the creative until the auction ends, which is why a bad creative can ride a vendor ID that looked legitimate on a registry. The mitigation the researchers point at the industry is tighter control of who may bid, and of what code a creative is allowed to run. It is not a speech telling users to be more careful with their fingers.
the sentence to keep
An ad is code that runs because a page rendered, after an auction you did not see. Zero-click means your finger was not the switch. It does not mean every rectangle was a break-in. On 15 October 2026 the careful count is 45 Windows computers at one newsroom, confirmed from logs, and a separate count of hundreds of millions of auction wins that the researchers themselves say are not infections. The picture on the sign is the decoy. The program in the hole is the thing.