:quality(90):no_upscale()){kind=logo}
Ad-Delivered Spyware Reached US and EU Government Networks, Raising the Stakes for Device and Browser Policy
STATUS: Confirmed Zero-Click Spyware Delivery SEVERITY: 7/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Nov 6, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
Citizen Lab has confirmed the first zero-click mercenary spyware attack delivered through targeted ads, with Candiru spyware infecting at least 45 devices at an international news network. The ad vendor behind it, Discover-Tech, placed ads that reached government networks in the US and across Europe, including EU institutions and defense ministries. An ad impression does not confirm infection, but the exposure makes enforced, verified device and browser policy an immediate priority for governments and critical infrastructure operators.
What Happened
Displaying a targeted ad was enough to infect a device which makes device and browser policy the control that matters.
On October 15, Citizen Lab, with a parallel investigation by Confiant, published findings on AdFection which it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads. Discover-Tech, a company that presented itself as an ad vendor, bought ads containing a script that contacted its own server and passed along the viewer's advertising identifiers. The server then decided, apparently from those identifiers and the viewer's IP address, whether to return code, and for most viewers it returned nothing. Citizen Lab links attacks on at least 45 devices at an international news network in 2024 and 2025 to Candiru spyware delivered this way, with high confidence.1
Citizen Lab analyzed nearly four billion Discover-Tech bidding records and found its ads on almost 200,000 websites and apps across dozens of countries in four months. Discover-Tech appeared on Google's and IAB Europe's lists of certified and approved vendors from 2020 until both removed it in early October 2026. Citizen Lab stresses that an impression alone does not confirm targeting or infection.1
In the US, the exposure has become a policy question. Confiant's analysis found signs of the ads on US government networks, and Citizen Lab found impressions on government networks in many countries1. One US senator has urged agencies to disable ads on government browsers and turn off mobile advertising IDs and a second says the report shows the need for stronger privacy protections. Several US agencies already block ads or recommend doing so2 and the NSA and CISA warned in 2018 and 2020 that malicious ads can deliver malware and recommended ad blocking.1
The European exposure is equally direct. Citizen Lab found impressions on the networks of the European Parliament, the European Commission, and the General Secretariat of the Council of the EU, along with Sweden's national grid operator and armed forces. Confiant found signs of the ads on networks that include the Dutch Ministry of Economic Affairs, Estonia's Information System Authority, and Spain's Ministry for Digital Transformation.1 Discover-Tech also used IAB Europe's Transparency and Consent Framework to appear GDPR-compliant while targeting users in the EU and Citizen Lab calls on regulators to investigate. IAB Europe says the findings point to misuse of technologies inherent to the web, not a broken advertising infrastructure, and that investigating spyware is a matter for the authorities.1,2
The defenses Citizen Lab recommends are device and browser policies. It judges blocking targeted ads at the gateway the most feasible protection and it recommends blocking ads and tracking on work-issued devices, using device management to opt managed devices out of ad targeting and disabling unique advertising IDs on government mobile devices.1,3 Discover-Tech targeted by advertising ID, browser cookie ID, and IP address, so disabling advertising IDs closes one path and leaves the others, which makes layered, enforced policy necessary. These are recommendations, and they protect only the devices and browsers where an organization actually enforces them.
What It Means
Finding | What It Means | Operational Consequence | Open Question |
AdFection delivered spyware when a targeted ad was displayed, with no click, and Discover-Tech's ads reached networks of government bodies, defense ministries, and EU institutions. | Staff caution and link avoidance offer no protection against an attack that needs no user action. | Protection has to come from how the devices and browsers that render the ad are configured. | Which devices in an organization render ads from ad networks today and which have any ad or tracking controls in force. |
Discover-Tech targeted victims by mobile advertising ID, browser cookie ID, and IP address. | Closing one identifier path, such as disabling advertising IDs, leaves the others open. | Policies have to layer: advertising IDs disabled, ad and tracker blocking in browsers, and filtering at the gateway or DNS layer. | Whether an organization can verify that each layer is enforced on every managed device. |
Citizen Lab's recommendations for government devices are advisory, and for personal devices used in government spaces it offers guidance and not direct control. | Protection ends at the edge of what the organization manages. | Staff who work on machines the organization does not manage, or who move sensitive conversations to consumer apps, fall outside any enforced policy unless their work is confined to a governed environment. | How many staff use personal devices or consumer apps for official business, and what managed channel they have instead. |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Advertising on work devices is a nuisance and a privacy matter, not a security control point. | Ads can carry code, and displaying an ad can profile or infect a targeted device, so the ad path is an attack path. | BlackBerry® UEM enforces device and browser policies on managed devices, including settings that limit ad tracking, and reports whether each device complies. |
A policy telling staff to disable ad tracking or avoid ad-supported apps is sufficient. | The attack needs no user action, so a policy protects a device only when it is enforced and verified and does not depend on each user changing a setting. | BlackBerry UEM applies the policy centrally and flags devices that drift out of compliance, so enforcement does not rest on user behavior. |
Device controls cover everything staff use for official business. | Controls reach only managed devices and staff who use personal devices or consumer apps for sensitive conversations fall outside them. | BlackBerry® SecuSUITE® gives staff a governed channel for sensitive conversations that limits what a compromised device exposes, though a communications product cannot repair a compromised device. |
Recommended Actions
IMMEDIATE | Confirm through device management that advertising IDs are disabled and app tracking is restricted on all government-owned or organization-managed mobile devices and report every device that does not comply. |
IMMEDIATE | Enforce ad and tracker blocking in managed browsers and block ad and tracking domains at the gateway or DNS layer. |
SHORT-TERM | Apply the strictest enforced policy first to staff with access to sensitive information, including executives, defense and policy staff, and administrators. |
SHORT-TERM | Require contractors, partners, and staff on machines the organization does not manage to reach work applications through a governed browser, with ad and tracker policy enforced centrally and work data isolated from the rest of the machine. |
ONGOING | Give staff a managed channel for sensitive conversations that is practical enough to replace consumer apps and write guidance for personal devices used in offices and operations centers. |
BlackBerry Position
Citizen Lab's evidence shows that a targeted ad can reach the networks of defense ministries, EU institutions, and US government bodies in the same way and that displaying an ad can be enough to infect a device. Because users don’t need to click the ads to be served malicious software, protection depends on how devices and browsers are configured and a policy protects a device only when it is enforced. Governments and critical infrastructure operators in the US and Europe should enforce ad-tracking, browser, and gateway controls on every managed device, extend a governed browser to the machines they do not manage so work data stays isolated from the rest of the machine, verify that policies stay in force, and give staff a governed channel so sensitive conversations do not move to apps the policy cannot reach.
Citations:
1. Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (The Citizen Lab, Report 195, with Confiant's parallel investigation, October 15, 2026).
2. Senators say targeted ads are a security risk. Ad groups say the critics are off base (CyberScoop, October 23, 2026).
3. 'AdFection' Turns Online Ads Into Spyware Delivery Tool (Dark Reading, October 19, 2026).
:quality(90):no_upscale())