Targeted Ads Delivered Zero-Click Spyware. What African Publishers Should Check

A company can participate in established advertising systems while its infrastructure is being used to facilitate spyware delivery. The AdFection investigation raises a difficult question for digital publishers: what does a vendor’s accepted status actually guarantee about the safety of advertisements it delivers?

In a 15 October investigation, Citizen Lab documented how Discover-Tech advertising infrastructure was used to deliver Candiru spyware, rebranded as Integrity Labs, in attacks involving Al Jazeera devices. The researchers named the technique AdFection because an advertisement could initiate an attack without the target clicking anything.

Our comparison of the technical findings with IAB Europe’s formal response reveals an important accountability gap: participation in an advertising consent framework is not the same as an independent security assessment of the code a vendor can deliver. For publishers, the practical question is what evidence they should demand before trusting an advertising partner.

How ordinary advertising infrastructure became an attack route

Websites and apps often use real-time bidding to select advertisements. Publishers typically connect to advertising intermediaries, which receive bids from advertisers and determine which advert appears. The code delivered with an advert may also communicate with external servers.

Citizen Lab found that Discover-Tech’s infrastructure could gather information about devices and selectively deliver JavaScript when a device matched targeting criteria. That code could initiate further exploitation, potentially resulting in spyware installation. Because the process could begin when the advertisement rendered, a user did not need to click an advert or approve a download.

The investigation linked attacks to at least 45 devices at Al Jazeera during 2024 and 2025. This figure identifies devices targeted; it should not be interpreted as proof that every device was successfully infected.

The scale of the advertising data provides another warning. Citizen Lab analysed almost four billion bidding records covering four months in 2026. Within the MyDSP data, researchers identified approximately 718.7 million bids, about 19 percent of the records as relating to advertisements that apparently contained script tags pointing to a particular server. This does not mean 19 percent of all online advertisements were malicious, nor that the same proportion of users was infected. It describes a pattern found within the dataset examined by the researchers.

The four stages publishers must distinguish

The case is easier to assess when advertising exposure is separated from evidence of compromise.

1. An advert is displayed. This establishes an impression, not an infection. A website carrying an advert is not necessarily malicious or knowingly involved in the activity.

2. The advert collects information. Browser identifiers, accessible cookies or network information may be transmitted for tracking or profiling. This can create a privacy problem even when no spyware is delivered.

3. A device is selected for an attack. The infrastructure may return additional code or direct the device towards exploitation. Evidence of targeting is more serious than an ordinary impression, but investigators must still establish what happened next.

4. The device is compromised. Claims of infection require evidence supporting that conclusion, such as relevant device or network telemetry. An advert appearing on a website, by itself, cannot establish compromise.

This evidence ladder helps publishers avoid two mistakes: treating every advertising impression as a spyware infection, or dismissing an advertising incident because there is no obvious malicious link for a user to click.

Why vendor-list status is not enough

Following the investigation, Google ended Discover-Tech’s access to its ad-exchange platforms in early October 2026. Beeswax removed the company from its ad-buying platform, Vungle, operated by Liftoff, paused access while reviewing the issue, and Eskimi blocked its accounts and domains.

On 15 October, IAB Europe announced Discover-Tech’s suspension from its Global Vendor List following an audit that identified violations of its Transparency and Consent Framework policies. IAB Europe also stated that it was not equipped or mandated to independently investigate conduct beyond the framework’s substantive scope.

That qualification is important. A consent framework deals with specific transparency, consent and data-processing requirements; it is not a universal guarantee that every participating vendor’s code has passed a comprehensive cybersecurity audit. The concern is not that privacy frameworks are useless, but that publishers should not mistake one form of compliance for a different kind of assurance.

A technical analysis published by Confiant alongside the Citizen Lab investigation provides further examination of the advertising infrastructure involved. Together, the findings show why vendor screening needs to consider both data practices and the technical behaviour of advertisements.

TVA’s four-check test for advertising partners

Publishers do not need to reproduce a spyware investigation to ask stronger questions of their advertising providers. TechView Africa recommends using the following four checks when reviewing advertising networks, resellers and third-party scripts.

Map the vendor chain. Ask which companies can participate in serving an advert, including intermediaries and downstream vendors. Keep the inventory current when partners or integrations change.

Understand what code can run. Ask how providers screen advertisements whose behaviour changes according to audience or device. Seek evidence of script review, external-domain monitoring and escalation procedures rather than relying solely on a visual approval process.

Establish what data is collected. Ask which identifiers and device signals are processed, which parties receive them, how long they are retained and how the provider responds to suspected misuse.

Verify the response process. Establish who can suspend a vendor, preserve relevant logs, investigate an incident and notify the publisher. Ask for defined response responsibilities rather than a general promise to investigate security concerns.

This is an editorial assessment framework, not a certified security standard. Its purpose is to turn the AdFection findings into questions publishers can put directly to their suppliers.

What readers in Nigeria and across Africa should do

The investigation does not establish that Nigerian users were infected through AdFection. Readers should nevertheless keep their devices and browsers updated and use reputable content-blocking tools where appropriate. Ad blockers may reduce exposure to advertising and tracking, but they cannot guarantee protection against sophisticated spyware; security updates address known vulnerabilities but cannot eliminate every targeted exploit.

TechView Africa’s guide to checking an Android phone’s security patch level explains how readers can check their device’s update status. Our explainer on what an email appearing in a data breach actually means also covers the difference between exposure of information and proof that an account has been compromised.

Anyone with specific reasons to believe they have been targeted should seek qualified digital-security assistance instead of assuming that routine consumer tools are sufficient.

Our Recommendation

AdFection exposes a gap between the systems used to approve advertising vendors and the evidence publishers need to assess security risks. A vendor-list entry may offer information about participation in an industry framework, but it cannot substitute for scrutiny of code delivery, data collection and incident response.

African publishers should ask their advertising partners to demonstrate how these risks are managed, document the responses and establish a clear process for isolating suspicious integrations. Readers should keep their devices updated without interpreting an ordinary advert impression as evidence of infection.

The practical lesson is not to abandon online advertising. It is to demand better evidence about the companies and code involved in delivering it.