Issue 02

  1. Newscitizenlab.ca

    Exposing AdFection

    Citizen Lab reports the first public confirmation of zero-click mercenary spyware delivered when a targeted advertisement renders, a technique it calls AdFection. Discover-Tech placed those ads, and devices at Al Jazeera were infected with spyware from Candiru, rebranded as Integrity Labs. Google and IAB Europe removed Discover-Tech from their advertising vendor lists in early October 2026.

    Why it matters

    A rendered ad was enough to deliver zero-click spyware, so the advertising stack itself is an exposure path.