The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Citizen Lab says an ad-tech operation used ordinary ad impressions to identify selected devices and, in confirmed cases, route them toward mercenary spyware. The visitor did not need to click: code loaded when the ad rendered, sometimes in the background.
What Citizen Lab found
On October 15, 2026, the University of Toronto’s Citizen Lab published Report 195, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware. The lab described it as the first public technical confirmation of mercenary spyware delivered through targeted advertising without a user click.
“This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” the report states. Citizen Lab linked the activity with high confidence to Candiru spyware infections affecting Al Jazeera devices.
How an ad impression could become an attack
1. A normal-looking ad wins an auction
Discover-Tech participated in automated ad auctions and placed apparently benign advertisements on websites and inside Android and iOS apps. The visible creative could look like an ordinary commercial message.
#1 Best Overall
- Privacy Protection and Lens Care: Avoid private information from hacking while preventing dust-fall and scratching of the camera lens
- Multiple Compatibility: Suitable for Logitech webcam C920x, C920, C922, C930e, C922x Pro Stream HD Camera
- Artful Design: Modeled and designed exclusively to fit the above devices from Logitech and make it more stylish
- Easy Flip Mechanism: Can be turned 180 angle and easily take the cover off when flipping more than 180
- Simple Installation: Attaches securely to your Logitech webcam without leaving residue, allowing for quick and hassle-free setup
2. The ad requests code from the buyer’s infrastructure
When the ad rendered, code associated with the ad requested JavaScript from Discover-Tech infrastructure. That request could occur even when nobody interacted with the advertisement, including when it rendered outside the user’s immediate view.
3. The server decides whether the visitor is a target
Discover-Tech could use the visitor’s public IP address, advertising identifiers, cookies, browser characteristics and operating-system information to determine whether the device matched a target profile. The report also describes identity syncing that correlated users across advertising vendors.
4. Selected devices receive the next stage
Only devices judged to be of interest were sent malicious JavaScript. That code could execute in the browser or app and attempt to exploit the device. The benign advertisement did not necessarily contain the exploit itself, which helped conceal the operation from ad platforms and automated ad-verification systems.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- Privacy Protection: CloudValley webcam cover is designed for those who prioritize privacy, security, and peace of mind when using laptops, tablets, and computers
- Fashion Design: The space aluminum alloy webcam cover features a subtle design which compliments the beautiful aesthetic of top devices
- Ultra-Thin Design: Measures only 0.023 (0.6 mm) inch thin, ensuring it does not interfere with closing your laptop or device while providing reliable camera coverage
- Broad Compatibility: Works flawlessly with most laptops (MacBook, HP, Dell, Asus, Acer, Lenovo), All-in-One PCs and leading tablets including iPad, Surface Pro, Galaxy Tab, Fire HD, and Google Pixel Tablet
- Simple to Use: Only need to align to the webcam, attach and press it firmly for 15 seconds. Does not interfere with web use or indicator light
This is why “I never clicked the ad” does not rule out exposure. The triggering event was the ad’s rendering and the network requests that followed, not a click or download deliberately initiated by the visitor.
What is confirmed, and how large was the infrastructure?
| Measure | What the report says | Qualification |
|---|---|---|
| Al Jazeera devices | At least 45 devices were targeted during 2024 and 2025. | Citizen Lab found network sequences connecting an ad impression to Discover-Tech infrastructure, then to a Candiru validator and Candiru command-and-control infrastructure. |
| Ad-bidding records | Four billion Discover-Tech bidding records were analyzed. | The records indicate the scale of the operation; they do not mean four billion devices were infected. |
| Websites and apps | Nearly 200,000 unique websites and Android/iOS apps appeared in the records. | The inventory spanned dozens of countries. |
| Profiling and infection traffic | Millions of devices were directed to profiling and infection servers, according to the report. | The report does not establish that every contacted device was infected. |
The strongest technical evidence concerns the Al Jazeera cases. The broader bidding and profiling data show reach and targeting capacity, but they cannot be read as proof that every ad impression delivered spyware.
Who operated the ad-to-spyware pipeline?
Citizen Lab identified Discover-Tech, an Israel-based company led by CEO Dekel Boni, as the ad-tech operator. It said the company ran Controlium, a control-panel-style platform for mercenary spyware customers.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
The report linked that platform to Candiru, which it reported as owned by U.S.-based Integrity Labs, as well as Bindecy and Intelos. These links describe the infrastructure and relationships documented by Citizen Lab; they do not identify every customer or establish a final legal finding.
Discover-Tech appeared on “certified” or “approved” vendor lists maintained by Google and IAB Europe and served ads through networks including Google, Yandex and Beeswax. That matters because an approved status or access to a major exchange can make a malicious buyer look like a routine participant in the advertising ecosystem.
What happened at Al Jazeera
For at least 45 Al Jazeera devices, Citizen Lab observed a repeated network pattern: an ad impression was followed by contact with Discover-Tech infrastructure, then a Candiru validator server, and finally Candiru command-and-control infrastructure. The lab connected those traces with Candiru infections during 2024 and 2025.
Rank #4
- 【Premium Webcam Cover】This webcam privacy cover is an accessory of computer webcam. No worry about interfering with web camera lens use or indicator light; No damage to your device in any way as well. A helpful privacy protector and dust separator
- 【Privacy Protector】Slide the web camera cover over your webcam lens when not in use, and prevents web hackers from Spying on you. It is perfect to provide privacy security and peace of mind to individuals, groups, organizations, companies and governments. It also protects your camera lens from dust, and keeps it in high-definition resolution all the ways
- 【Durable Material】The web cam cover is made of high-strength plastic, which ensures that your privacy is protected for a long and lasting period of time. The back of the web camera privacy cover slide also has a strong 3M adhesive layer. It helps the privacy protector stick firmly to your device. The most convenient, super thin design, and extra mini size, make it perfectly combine with your devices
- 【Wide Compatibility】This webcam cover is compatible with most popular webcams with flat area surrounding lens or with protruding lens, such as Logitech HD Pro Webcam C920 C920x C930e and C922, Logitech C615 and C270 (NOT fit Logitech C910, B910, C310). It can be also used as a cover for the peep hole on door
- 【For Logitech Webcam Cover】 The streamcam cover kit comes with 2 pack. Please clean the lens surface before applying. Make sure the mounting surface is cleaned completely so that it sticks properly and firmly
The findings do not show that every employee, device or advertisement at Al Jazeera was compromised. They show that a targeted advertising path was technically capable of selecting specific devices and leading them into a known spyware delivery chain.
How the advertising ecosystem responded
- Google: Citizen Lab reported that Google terminated Discover-Tech’s access to its ad-exchange platforms and deployed Safe Browsing protections for known actor-controlled domains.
- Beeswax: The company removed Discover-Tech from Buyer Cloud.
- Vungle (Liftoff): Access was paused while the company reviewed the activity.
- Eskimi: It blocked the relevant accounts and domains.
Eskimi told Citizen Lab that the actor loaded different code depending on the viewer, including the device, IP address and location, and that campaigns were often restricted to very narrow IP target lists. That response illustrates how targeting rules can be used as a security control and as an evasion technique at the same time.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What this means for ordinary users and organizations
An ad impression can expose network and device identifiers without a click. The risk is not limited to people who visit obviously suspicious sites: automated advertising places the same code across a large and changing inventory of sites and apps.
Best Value
- 【Protect Privacy Security】Focusing on network security, now we can easily and effectively protect personal and family privacy security , Just gently slide the slide and close the camera, you can stop the intrusion of hackers.
- 【 Ultra Thin Design】The new ultra-thin design, with a thickness of only 0.022 inches, is made of flexible ABS material and is not fragile. Will not affect the closing of the laptops and scratch the laptops.
- 【Easy to install】 Strong adhesive makes the cover not fall, keep the screen clean and free of stains during installation, tear off the adhesive tape on the back, align it with our camera, and press hard for 10 seconds to work.
- 【Compatible with 】Compatible with camera for Laptop, tablet, computers, Echo Show and Apple Devices,as: MacBook Pro,Macbook Air,iMac ,Mac mini,iPad,MacBook Air, iPhone 6/7/8 Plus etc front camera .
- [What you get] 6 pack black webcam covers.
For an individual, keeping the browser, operating system and apps updated remains important because the attack depends on exploiting software after the target is selected. Limiting unnecessary ad and tracking requests can reduce the number of third-party connections made during page and app loading, although no single setting guarantees protection against an unknown exploit.
Organizations should treat advertising traffic as part of their attack surface, especially on work-issued devices used by journalists, executives, researchers or people handling sensitive sources. Citizen Lab recommends blocking online ads and tracking at organizational gateways and on work-issued or edge devices, and using device-management controls to opt out of ad targeting where that option is available.
Choosing a defensive control
The useful distinction is coverage, not a particular brand. A defense should be evaluated against the environment it must protect:
Recommended Free Tools
| Control location | Scope | What to check | Trade-off |
|---|---|---|---|
| Browser or single-device blocking | One supported browser or device | Whether it blocks third-party advertising and tracking requests before they load | Limited coverage for other browsers, apps and unmanaged devices |
| Network or DNS gateway filtering | Devices using the organization’s network or resolver | Central policy enforcement, domain blocking and logging across browsers and apps | Needs maintenance and may not cover devices on other networks |
| Managed-device policy | Enrolled workstations and mobile devices | Centralized settings for ad targeting, browser protections and software updates | Requires enrollment, administration and exceptions for legitimate services |
For a managed environment, combining network-level filtering with device controls gives broader coverage than relying on a single browser setting. Remote workers and mobile users need particular attention because they can bypass an office gateway.
What the report does not establish
- It does not show that every ad impression caused an infection.
- It does not identify all government customers of the spyware ecosystem.
- It does not provide a final criminal or regulatory outcome.
- It does not rank commercial ad blockers, gateways or device-management products.
Citizen Lab called for regulators to investigate those unresolved questions. The confirmed Al Jazeera evidence and the much larger ad-bidding footprint should therefore be read together: one demonstrates infection-linked delivery, while the other demonstrates the potential scale of the targeting machinery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
