iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A phone can be compromised by an apparently ordinary advertisement without the user tapping it. Citizen Lab’s Report 195, published October 15, 2026, documents “AdFection,” a system in which ad-auction infrastructure identified selected devices and then served exploit JavaScript to their browser or app. The campaign was linked with high confidence to Candiru mercenary spyware and targeted at least 45 devices belonging to Al Jazeera journalists and staff in 2024 and 2025.
What AdFection is
Citizen Lab calls AdFection the first publicly confirmed case of zero-click mercenary spyware delivered through targeted advertising. The operation used Discover-Tech’s advertising infrastructure and its Controlium platform to connect spyware operators with the real-time-bidding ecosystem. The ad impression itself could appear benign to an exchange or publisher; the dangerous behavior happened when the impression contacted Discover-Tech-controlled systems and the server decided whether that device matched a target.
Citizen Lab links the campaign with high confidence to Candiru, also referred to in the report as Integrity Labs. Network evidence showed a repeatable path from Discover-Tech ad infrastructure to a Candiru validation server and then to command-and-control systems.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow a no-click ad infection worked
- An ad impression was purchased. Discover-Tech bought apparently ordinary advertising inventory through real-time bidding. The ads appeared across websites and inside Android and iOS applications.
- The impression made a background request. When the ad loaded, Discover-Tech infrastructure received advertising identifiers and the device’s IP information. That information could be collected even when the recipient was not selected for exploitation.
- The server checked eligibility. Discover-Tech’s backend compared the incoming identifiers and network details with targeting criteria. Most recipients received no exploit code.
- A selected device received JavaScript. If the server determined that the device was a target, it returned malicious JavaScript. The code ran in the browser or app as part of the ad-loading sequence, so no tap, link selection or download was required.
- The exploit reached spyware infrastructure. Investigators observed traffic from the advertising systems to a Candiru validator and subsequently to command-and-control servers, a temporal and infrastructure pattern that supported the attribution.
The separation between the ad and the exploit was central to the concealment. As Citizen Lab’s executive summary explains, the seemingly benign advertisement did not itself contain the exploit code. That made it harder for delivery platforms to identify the ad’s hidden purpose during normal creative review.
#1 Best Overall
- VLAN Network Segregation: This router includes five preconfigured VLANs that isolate IoT devices, guest users, and work systems into separate, secure networks. Each LAN port and every WiFi SSID can be assigned to a VLAN, giving you complete control over how traffic flows inside your home.
- Dual VPN Client and Server Support: The router works as both a VPN client and a VPN server, supporting OpenVPN, IPsec, and WireGuard. You can route selected VLANs through a VPN while keeping others on your regular ISP connection, giving each device group the exact level of privacy it needs.
- Full WiFi 6 on Both Bands: With dual-band WiFi 6 support, the router delivers modern wireless performance across 2.4GHz b/g/n/ax and 5GHz a/n/ac/ax. It improves capacity, stability, and speed while remaining compatible with older devices, making it ideal for busy homes with many connections. Wi-Fi Mesh is available after firmware update.
- High-Performance Hardware Architecture: Powered by the IPQ6000 quad-core ARM processor at 1.2GHz, along with 128MB flash, 256MB RAM, and hardware NAT acceleration, the router handles multitasking, streaming, VPN traffic, and VLAN isolation smoothly without slowing your network.
- Flexible and Powerful Parental Controls: You can use trusted services like OpenDNS, CleanBrowsing, and Cloudflare for filtering, then add custom block lists, allow lists, and schedules. The router includes defenses against common bypass attempts, letting families create rules that match each user. Best of all, it's subscription free!
Who was targeted and how large the operation was
Confirmed Al Jazeera targeting
At least 45 devices inside the international news organization Al Jazeera were targeted during 2024 and 2025. The available public evidence does not identify the government customer behind each attack. It does show the network sequence associated with the attempted infections, rather than merely an isolated suspicious advertisement.
Advertising reach
Citizen Lab analyzed four billion Discover-Tech bidding records. Those records placed the company’s ads on almost 200,000 unique websites and Android or iOS apps in dozens of countries. Millions of devices were directed to profiling or infection servers. A device did not have to receive exploit code to be exposed to collection: identifiers and IP information could still be recorded during the eligibility process.
Rank #2
- 【WiFi 6 Standard with low-latency】Wi-Fi 6 speeds up to 1.8 Gbps to let you enjoy smoother 4K streaming, gaming, video calls and more (600Mbps (2.4GHz), 1200Mbps(5GHz))
- 【Faster OpenVPN&Wireguard】Wireguard VPN speed up to 500 Mbps, giving you complete control over your gaming, steaming and working bandwidth. Actual speed may differ depending on internet service provider, network environment, VPN server location, VPN service provider, etc.
- 【AdGuard Home & EAP Supported】AdGuard Home is a dedicated Internet filtering software for blocking ads and online trackers. We integrated it with Web UI for optimal control and management.
- 【Easy Setup】Follow the Initial Set-up video tutorial on Amazon or Connect AX1800 to your computer via Ethernet cable to access the web Admin Panel
- 【Connect up to 120 devices】Using revolutionary OFDMA technology to efficiently allocate channels communicate with multiple devices simultaneously help you increase capacity and efficiency
These figures describe the reach of the advertising and profiling infrastructure, not a count of confirmed spyware infections. The report distinguishes the broad population that encountered tracking or selection servers from the much smaller set for which exploit delivery was observed.
AdFection compared with other delivery methods
| Characteristic | AdFection | Typical malvertising | Earlier zero-click spyware campaigns |
|---|---|---|---|
| User interaction | None; the selected device can be attacked while an ad loads. | Often relies on a click, a visit to a landing page or a download, although methods vary. | None, but delivery has more commonly involved a message, call or network-level pathway. |
| Delivery layer | Real-time ad auctions and ad-rendering requests. | Advertising inventory, usually with a malicious creative or destination. | Messaging systems, telecom or network injection, or another direct delivery channel. |
| Targeting data | Advertising identifiers, IP information and device-fingerprinting signals available to the ad ecosystem. | Audience or contextual targeting, sometimes combined with ordinary web tracking. | Target identifiers gathered through the spyware operator’s own delivery channel. |
| Exploit execution | Server-selected JavaScript is returned only after an eligibility check. | Usually occurs after the user reaches or activates the malicious destination, depending on the campaign. | Exploit code is delivered through the message or network path chosen by the operator. |
| Public evidence in this case | Network-log timing, a Discover-Tech infrastructure pattern and a Candiru validator-to-command-and-control sequence. | Often a malicious creative, redirect chain or compromised site identified through browser or server analysis. | Evidence varies by campaign and may rely on device forensics, message records or carrier telemetry. |
| Intermediary accountability | Ad exchanges, vendor registries, consent systems and publishers all become relevant control points. | Responsibility usually centers on the ad network, publisher and landing-page host. | Responsibility centers on the spyware operator and the service or network used for delivery. |
Which companies and systems were involved
The report names Discover-Tech’s Controlium platform and a NOAS/getAd server pattern in the infrastructure. Citizen Lab also reports relationships or advertising transactions involving Google, Yandex, Beeswax, Vungle/Liftoff, Eskimi, Sunteng and Xandr/Microsoft Advertising. Mention in the infrastructure or transaction records does not by itself establish that every named company knew about, approved or participated in the spyware activity; the report’s findings concern how the ad ecosystem was used and where controls failed.
Rank #3
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
What platforms did after the findings
- Google terminated Discover-Tech’s access to its exchange.
- Google and IAB Europe removed Discover-Tech from vendor registries.
- Beeswax removed Discover-Tech.
- Vungle/Liftoff paused access while it reviewed the activity.
- Eskimi blocked associated accounts and domains.
These actions address the supply chain rather than relying on every phone owner to identify an invisible exploit. They also show why vendor identity, domain history, account ownership and auditable bidding records matter when ad systems can deliver code to millions of devices.
What individuals and organizations should do
Keep the device and browser current
Install operating-system, browser and application security updates promptly. A zero-click chain depends on an exploitable component, so reducing known vulnerabilities is a basic defensive measure. Updates do not prove that a particular campaign is stopped, but an unpatched device has fewer protections against known exploit techniques.
Rank #4
- 【Large Size for Compatibility】WIFI router emf shield is 12 inches long x 11 7/8 inches high x 5 1/2 inches wide. You only need to confirm the size of your router. The width of the EMF-proof WiFi router cover is the key consideration.Fits the large WiFi routers like, Comcast, Xfinity, ATT Uverse...
- 【Benefits of protecting WIFI cover】 The emf blocker for wifi router is crafted from high-quality polymer materials and effectively blocks approximately 90% of EMF emitted by large WiFi routers, including new 5G models. Safeguard your family from electromagnetic fields with this product. The cover boasts excellent electrical conductivity and shielding capabilities. Designed as a Faraday cage, it is easy to use and provides complete coverage for routers, especially larger ones.
- 【Good Performance】The EMF-proof WiFi router cover features a honeycomb design that allows for natural airflow and cooling. Simply fold the entire modem/router to optimize performance. Even when covered, the WiFi router functions normally. The EMF-proof WiFi router cover preserves the range of WiFi signals we typically use.
- 【Protecting From Now】The proximity of harmful sources to our bodies directly affects the amount of radiation we are exposed to. Additionally, the longer the exposure time, the greater the potential harm. As we rest or engage in entertainment activities at home, the router's radiation is constantly present. However, with this cover, we can significantly improve our health and well-being.
- 【Promoting a Greener Living Environment】While the harmful effects of WiFi routers may not be extremely high, they still emit microwave radiation. Numerous studies have linked this radiation to various illnesses and neurological problems. Often, we believe we are keeping our children safe without realizing the dangers of exposing them to electromagnetic toxins. This WiFi router cover offers protection against such risks.
Take spyware warnings seriously
If a device, account or organization receives a credible spyware warning, treat it as an incident rather than ordinary spam. Follow the platform’s warning guidance, involve qualified incident responders and avoid wiping or resetting the device before experts determine whether evidence is needed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Preserve network evidence
Keep relevant firewall, DNS, proxy, mobile-device-management and endpoint logs. Record timestamps, domains, IP addresses and application versions. Citizen Lab’s attribution depended on the timing and sequence of network connections; deleting those records can remove the information investigators need to distinguish an advertising impression from an exploit attempt.
Best Value
- RF radiation caused by router. Modem/Wifi Cover provides over 60dB shielding! Shielding frequency range of 10MHz to 3GHz and still over 99.6% effectiveness at 5.6GHz.
- Material: copper material with breathable radiation protection fabric that allows a natural air flow for cooling. Just tuck around the entire modem/router for the greatest amount of reduction of radiation, or if you want more radiation/stronger signal to leak through, you may only partially place onto the router antennas. Adjust it as you wish. Not advised to wash.
- Features and Functions-Router and wireless radiation blocking up to 99%,block yellow dust and fine dust to protect router.It can protect your head from electromagnetic waves and sleep better.
- SIZE:13.7x15.7 inch.Customized is accepted. If you need customized please tell us.You can also buy the fabric from us and make it yourself which is much cheaper.
- REFUND: This Shielding Cover is proved to reduce EMF and RF radiation. If you are not completely satisfied with your purchase, just return it to us within 30 days for a full money-back refund. And any questions please tell us.
Demand stronger ad-tech controls
Organizations that buy or publish advertising should require clear vendor ownership, domain and account verification, abuse reporting, independent auditing and the ability to suspend a vendor quickly. Exchanges and consent frameworks should inspect not only the visible creative but also the destinations and scripts contacted during ad rendering. The report does not establish that a generic ad blocker, consumer antivirus product or accessory stops this exact chain, so those tools should not replace patching, monitoring and professional incident response.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What remains unknown
The public report does not name the government customer behind each operation. Citizen Lab also says a separate investigation called DARK CARTOGRAPHER will be detailed later. Those limits do not erase the technical finding: the documented infrastructure shows that targeted advertising can serve as a zero-click exploit trigger while keeping the exploit itself out of the ad creative reviewed by delivery platforms.
Why AdFection matters for online advertising
AdFection turns ordinary ad infrastructure into a precision delivery layer for mercenary spyware. Real-time bidding supplies global reach, identifiers and rapid server-side decision-making; the attacker needs to expose exploit code only to a narrowly selected device. That combination creates a governance problem as much as a security problem. Regulators, exchanges, publishers and app platforms must be able to audit who is buying inventory, what code an impression causes to load and which vendors can change behavior after approval.
Citizen Lab describes the incident as evidence of structural flaws in online advertising, including mass abuse and privacy invasion. The practical lesson is that an ad can be dangerous even when it contains no obvious malicious link and asks nothing of the user. Preventing the next campaign requires controls at the advertising and platform layers, backed by device updates and careful preservation of evidence when a targeted attack is suspected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
