Zero-Click Spyware in Ads Changes How You Govern Devices

On October 15, 2026, Citizen Lab published Exposing AdFection, which it describes as the first public technical confirmation of mercenary spyware delivered through targeted online ads without requiring a click. The researchers link attacks on at least 45 Al Jazeera devices in 2024 and 2025 to spyware from Candiru, a vendor that has rebranded as Integrity Labs. If simply displaying an ad can infect a phone, telling staff to be careful is not enough. Device security remains the first line of defense, but governments and critical infrastructure operators also need to ensure sensitive conversations take place on managed devices and through governed communications channels.

What the Citizen Lab Report Establishes

The report traces how an ad can become an attack path. Discover-Tech, an Israeli company, bought ads containing a script tag. When an ad loaded, the tag contacted a Discover-Tech server. The server apparently used the user’s IP address and advertising identifiers to decide whether to return code. If the user was not a target, it returned an empty response.

The operation had broad reach. Citizen Lab analyzed almost four billion Discover-Tech bidding records and found its ads on nearly 200,000 websites and apps across dozens of countries over four months. Discover-Tech remained on Google and IAB Europe lists of “certified” and “approved” vendors from 2020 until both organizations removed it in early October 2026.

What the Report Does Not Establish

An ad impression is not proof of infection. Citizen Lab says an impression “does not in and of itself confirm targeting or infection,” although it would have resulted in profiling. The report also does not identify which governments use these capabilities. TechCrunch’s coverage centers on governments, but that framing should be checked against the report before it is repeated.

The report does establish reach. Discover-Tech ads appeared on networks used by ministries of defense, armed forces, national cyber agencies, NATO, and critical infrastructure organizations, including Sweden’s national grid operator. That shows exposure, not confirmed compromise.

Operational Consequences for Government and Critical Infrastructure

Malicious ads can reach apps and websites used by defense personnel, political leaders, and people who maintain critical infrastructure. A compromised phone may expose the information stored on it and the communications that pass through it. The usual advice to avoid suspicious links offers little protection when no click is required.

Procurement teams should ask suppliers how they address advertising on devices connected to government programs. Compliance teams also need to consider records management, because messages exchanged through personal apps may fall outside normal retention and audit controls.

What Citizen Lab Recommends for Defenders

Citizen Lab considers gateway-level blocking of targeted ads the most practical defense until the advertising industry can reliably stop this type of attack. It recommends blocking ads and tracking on work-issued devices and at the gateway. It also recommends using mobile device management (MDM) to opt company-issued devices out of ad targeting. For government devices, it calls for disabling unique advertising IDs and developing guidance for personal devices used in government spaces.

These are recommendations, not legal requirements. The report also notes that the U.S. National Security Agency and the Cybersecurity and Infrastructure Security Agency warned in 2018 and 2020 that malicious ads can deploy malware and recommended ad-blocking.

Why the Channel Matters as Much as the Device

Managed-device controls apply only to devices the organization manages. When the official channel is slow, unavailable, or difficult to use, staff may turn to personal devices or consumer messaging apps. That is where ad-delivered spyware becomes hardest to govern. The report’s strongest measures apply to government-owned devices; for personal devices, it offers guidance rather than direct control.

Policy needs to address that gap. Staff need a managed channel that is practical enough to replace personal alternatives. Evaluate vendors against five criteria: control of infrastructure and encryption keys; independent certification, including its scope and covered version; verified participant identities; out-of-band operation that does not depend on the primary network; and accountability records that support post-incident review. BlackBerry® Secure Communications is designed around these criteria and is certified to NIAP and NATO Restricted standards.

A communications product cannot repair a compromised device. Device controls remain the first line of defense; a governed channel limits what happens next.

Steps for This Quarter

This quarter, inventory the apps and channels staff use for official business, including those used on personal devices and consumer messaging apps. Confirm through MDM that advertising IDs are disabled on government-owned mobile devices, and review whether ad and tracker blocking is enabled at the gateway and on work-issued devices. Write guidance for personal devices used in offices and operations centers, as Citizen Lab recommends. Name the managed channel staff must use for sensitive coordination, then test it under degraded primary-network conditions. Legal and compliance advisers should also distinguish binding obligations from advisory guidance, since this post is not legal advice.

The strongest defense against a zero-click attack is a controlled device carrying verified communications over a governed channel.