AdFection: Spyware Hidden Inside Online Ads

On 15 October 2026, the Citizen Lab and threat-intelligence firm Confiant published the first public, technical proof that mercenary spyware can be delivered straight to your phone through an ordinary targeted advertisement — no link to click, no file to open. They call the technique AdFection. In this episode, Aengus explains how the real-time ad auction that funds the internet quietly broadcasts who you are and lets strangers run code on your device, and how an Israeli firm called Discover-Tech turned that everyday machinery into a precision weapon for clients like the spyware vendor Candiru. We trace the whole pipeline: the Controlium control panel operators used to pick a single target, the “NOAS server” trick that hid the exploit from the ad networks, and the clean forensic signature behind the infection of at least 45 devices at Al Jazeera. We look at the staggering scale — nearly four billion bid records, impressions landing on NATO, EU institutions and critical infrastructure — and draw the lessons a security auditor draws about certification badges, unlocked back doors and lazy trust assumptions. Then: concrete privacy and security steps you can take tonight. Source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ This episode is for educational purposes only and is not financial or legal advice. Rules on crypto and privacy tools vary by country. AI disclosure: This episode’s script was researched and written with the help of AI. Facts were checked against public sources at the time of production, but crypto moves fast, so please verify anything important before acting on it.