Ad tags in the newly exposed AdFection operation passed third-party verification by serving different code according to the viewer, ad platform Eskimi says. For developers who load ads into their products, the consequence is uncomfortable: a clean scan can describe what the scanner received while missing what a selected user will run.
Citizen Lab's October 15 investigation links targeted advertisements purchased by Israeli company Discover-Tech to Candiru spyware infections at Al Jazeera. The researchers call this delivery technique AdFection. At least 45 devices at the broadcaster were targeted during attacks in 2024 and 2025. A separate four-month dataset covers ad delivery across almost 200,000 websites and mobile apps.
The banner starts a second delivery process
Discover-Tech's system sends a recipient's advertising identifier and IP address to its servers when an ad appears. Selected devices can then receive malicious JavaScript that exploits and infects them. Citizen Lab explains that keeping the exploit outside the initial advertisement helps hide its purpose from the platforms distributing it. The attack doesn't require the recipient to click the banner.
Ad-security company Confiant began examining an ad that triggered its scanner on April 12, 2026. Its analysis followed a remote script into a one-pixel iframe, an embedded browser frame, and roughly 90KB of obfuscated JavaScript. The apparent verification software established an encrypted communications channel and waited for instructions.
That code could collect device information and receive further JavaScript from its operator. Confiant says delivered code ran with the authority of the context hosting it, in this case an ad frame. It also cautions that many of the framework's collection functions would be unavailable inside an ad frame because of browser restrictions. The framework could probe WebGL graphics information and check which browser APIs were available before an operator sent more code.
Confiant did not capture a complete exploit chain in the wild. Its contribution documents the staging and selective delivery machinery. The attribution to Candiru relies on Citizen Lab's findings as well as similarities to earlier research. Keeping those contributions separate matters when deciding whether a particular network connection proves a device was compromised.
An impression is evidence of exposure
At Al Jazeera, network logs showed infected devices contacting Discover-Tech infrastructure, then a Candiru validator, then command-and-control servers. Investigators also examined a Windows DLL recovered from a compromised device. Its hardcoded servers and distinctive implementation details supported their high-confidence Candiru attribution. That combination goes further than observing an advertisement or a connection to a suspicious domain.
The wider exposure data requires more care. Citizen Lab found Discover-Tech ad impressions on networks associated with NATO and the United Nations, among other institutions. It explicitly warns that an impression alone confirms neither spyware targeting nor infection. The researchers assess that such impressions would at minimum have enabled profiling, with further code execution possible in some cases.
That visibility is incomplete, too. The impression dataset covers a limited period on Discover-Tech's MyDSP platform and excludes Beeswax and Eskimi data. You can't turn it into a complete victim count. Nor does the appearance of a familiar website in the findings establish that its publisher knowingly participated in spyware delivery.
Why one successful scan is a weak assurance
Eskimi says its independent verification providers and internal tools screened campaigns, but the remote loaders varied their replies by device, IP address and location. Campaigns were often confined to narrow IP target lists. Its own monitoring detected the behaviour and stopped individual campaigns and tags, according to the company's response to Citizen Lab.
The company says Discover-Tech's spending through its platform amounted to a few hundred dollars, with its final campaign stopped on August 6, 2026. It subsequently blocked associated accounts and domains. Discover-Tech had been a self-service advertiser there since 2022, Eskimi says. Those details describe its portion of the operation. The engineering lesson follows from its account: verification has to examine changing delivery behaviour, because a downloaded tag can make another decision after a scan has finished.
A frame limits access, while an exploit attacks the limit
Google's SafeFrame documentation describes one existing protection: put advertising content in an isolated iframe and control its communication with the publisher's page through an API. Google recommends using SafeFrame where possible, together with the HTML sandbox attribute to prevent top-level navigation. Its implementation also refuses the SafeFrame cookie API, so creatives cannot use that interface to read publisher cookies. SafeFrame has used randomized subdomains since January 2022 to strengthen isolation.
The configuration deserves an actual check. In Ad Manager, Google's documentation says new custom and third-party creatives have SafeFrame enabled by default, while standard and custom creative templates have it disabled by default. Publishers can use the Publisher Console to inspect an ad slot. These settings govern how the ad interacts with the page. They don't certify the operator's intentions or establish that a browser exploit will fail.
Chromium's security model adds another boundary. Site Isolation separates sites into sandboxed processes and restricts the sensitive cross-site data a process can receive. The browser team explicitly includes compromised renderer processes in its threat model. In plain terms, it plans for the possibility that an attacker has already broken into the component rendering a page and tries to contain the damage. The sandbox also aims to prevent a compromised renderer from accessing arbitrary local files or devices.
This helps explain why a remote JavaScript loader and a spyware infection are different findings. Ordinary script execution still has permissions and process boundaries around it. A successful attack must overcome the restrictions relevant to the access it seeks. Chromium also documents platform limits, including the absence of Site Isolation in Android WebView. A desktop browser's protections therefore shouldn't be assumed to describe every embedded browsing environment inside an app.
Removal leaves a separate investigation to finish
Citizen Lab says Google terminated Discover-Tech's ad-exchange access and deployed Safe Browsing warnings for known actor-controlled domains. Discover-Tech and Candiru did not respond to the researchers before their deadline.
The Guardian also sought comment from Discover-Tech.
Liftoff's October 12 response says it paused all Discover-Tech access while reviewing the allegations. It did not confirm the specific factual claims in Citizen Lab's letter. A suspension can interrupt a delivery route before the platform has completed its own investigation. Readers should preserve that distinction when comparing company responses with the researchers' conclusions.
For people at particular risk of mercenary spyware, Apple documents Lockdown Mode as an optional protection that restricts complex web technologies and other device features. Those restrictions can break website functionality. Apple describes the mode as an extreme option for the relatively few people who might be individually targeted by sophisticated attacks. It also changes messaging features, including blocking most attachment types. Apple advises updating devices before enabling it and warns that excluding websites or apps reduces protection. The support document describes a reduction in attack surface, which is a narrower assurance than a claim that it blocks every AdFection variant.
The next useful disclosures will show what the platforms found after cutting access: which delivery paths they removed, whether equivalent behaviour appeared elsewhere, and whether exposed organisations found evidence of compromise. Liftoff's review was still open in its published response. Its eventual findings will be more informative than treating the initial suspension as the end of the case.