According to PPC Land (19 October 2026), a Citizen Lab report of 15 October concluded, with “high confidence”, that targeted ads delivered Candiru spyware to at least 45 devices of Al Jazeera staff, with no click needed (“zero-click”), through the vendor Discover-Tech, which Google had listed since 2020. Google cut the vendor’s access in early October. The attribution is a research finding, not a legal one. The lesson for advertisers and agencies is about advertising supply chain hygiene.
What was reported
PPC Land summarises a Citizen Lab report of 15 October 2026. Citizen Lab concluded, with what it describes as high confidence, that targeted ads delivered Candiru spyware to at least 45 devices of Al Jazeera staff, through a technique it calls “AdFection”, without the target having to click. The vendor was Discover-Tech, an Israeli company Google listed as an ad vendor since 2020 and which IAB Europe registered in its transparency and consent framework on 2 July 2020.
The attribution to Candiru is a research conclusion, not a court ruling.
How it worked, according to the source
The ads called a server that sent malicious code only to devices on a target list. Scanners and other requests received an empty zero-byte response, so automated checks found nothing. Between March and June 2026, the campaign bid on 3.77 billion impressions and won 441.95 million, across 75,373 apps and 120,768 websites, with targets in 161 countries and spend of about 109,091 dollars.
The case shows that a real-time auction system can be used for very targeted delivery, hard to detect by automated inspection.
Discover-Tech case (Citizen Lab)
45
Al Jazeera staff devices targeted by ads carrying spyware
According to Citizen Lab (15 October 2026), via PPC Land. The attribution is a research finding, not a legal one. Google cut the vendor’s access in early October.
Company responses
Google cut Discover-Tech’s access in early October. Citizen Lab says IAB Europe did the same on 8 October, which PPC Land could not independently confirm. Vungle (part of Liftoff) paused all the vendor’s access pending a review. Eskimi said only “a few hundred dollars” passed through, a different scope from the 109,091 dollars figure. At the time of publication, the Trustworthy Accountability Group still listed the vendor.
The companies’ numbers measure different things and shouldn’t be compared directly.
An uncomfortable lesson: vendor lists aren't guarantees
The source concludes that Google’s and IAB Europe’s vendor lists rely heavily on companies’ own attestations, and that this case shows those attestations failed to screen out a bad actor. Also that automated analysis can fail when malicious code is only served to target devices, and that once a malicious ad is displayed, harm may already have occurred.
For an ordinary advertiser, this doesn’t mean your ads are dangerous. It means that whoever buys, sells or manages programmatic advertising depends on a chain of trust with flaws.
A vendor list is not a guarantee. Ask for placement reports.
What this means for an SME in Portugal
Most SMEs buy ads on Search, Shopping and social networks, where the risk of distributing malicious code through your account is low. The closer risk is different: third-party ads appearing on your site (if you sell space), poorly chosen technology partners, unclear distribution networks and agencies buying programmatic inventory without transparency.
If your company buys programmatic (display, video, audio), transparency about where ads appear and which vendors take part becomes a mandatory question.
Questions to ask whoever buys programmatic
Which platforms and vendors take part in the chain? Do we have access to placement reports and vendor lists? What security and quality checks do vendors run before ads are displayed? What domain and app blocklist do they apply? Who investigates reports, and how quickly?
A good answer is concrete, with names, processes and deadlines. A vague answer (“we work with the best”) is not enough.
Hygiene measures for any advertiser
Reduce the number of intermediaries; prefer platforms and vendors with transparent reports; use inclusion lists of sites and apps in display and video campaigns; exclude sensitive categories and unknown placements; review placement reports regularly; and keep a channel to report suspicious ads to platforms.
These measures also protect brand image: an ad of yours next to inappropriate content costs reputation, even without malware.
Questions for your manager
Do we buy programmatic? With which platforms and vendors? Which inclusion and exclusion lists do we use? Are placement reports reviewed? What do we do if we find a suspicious ad? And how do we inform the client?
If you want to review the risk in your ad buying chain, with a placement report and a list of measures, I can help set up the review, without alarmism and with priorities.
Frequently asked questions
What did Citizen Lab conclude?
With high confidence, that targeted ads delivered Candiru spyware to 45 Al Jazeera devices, with no clicks. It’s a research finding, not a legal one.
Are my Google or Meta ads at risk?
The source doesn’t indicate this. The case concerns a programmatic chain vendor. Risk for ordinary Search and social campaigns is low.
Was the vendor blocked?
Google cut access in early October, according to the source.