A spyware pipeline hid inside the ads iPhone owners scroll past
Advertisements that render on an iPhone may no longer just sell products. Researchers now say they can carry spyware, arriving without a tap, a link, or any visible prompt.
Citizen Lab documented what it labels AdFection, describing it as the first public technical proof that paid advertising can ferry mercenary spyware onto handsets. Working with the ad security firm Confiant, the Toronto lab tied the technique to silent infections at the broadcaster Al Jazeera, where at least 45 devices were hit in 2024 and 2025.
The trail runs through Discover-Tech, an Israeli advertising company that Citizen Lab describes as a front for ad espionage. Its Controlium platform let operators upload a single identifier, such as a device’s mobile advertising ID, then bid on ad space until an impression reached that exact handset. Once the creative rendered, code tucked inside the ad opened a channel back to the vendor’s own infrastructure. A handset on the shortlist was then pointed at a Candiru validation server that verified the target before any delivery attempt.
Mobile advertising IDs are the hinge. Both Apple and Google switch them on by default, and Citizen Lab found ad records placing impressions on networks tied to NATO, the United Nations and the European Parliament, alongside corporate networks including Apple, Intel and Nvidia. An impression is not proof of infection, the researchers caution.
Roughly four billion bid records were recovered, covering March through June 2026. Ads appeared across more than 75,000 Android and iOS apps and 120,000 websites.
Google cut off Discover-Tech’s ad exchange access after the investigation, and IAB Europe and Beeswax blocked the firm. Citizen Lab advises at-risk users to run a content blocker, restrict ad tracking and keep devices current.
