The Citizen Lab at the University of Toronto published technical evidence on October 15, 2026 showing that spyware can infect phones and computers without the person making a single click, distributed through digital ads. The report documents 45 devices belonging to the Al Jazeera network compromised between 2024 and 2025 by malicious code delivered through ad impressions.

The researchers named the finding AdFection. According to TechCrunch, the Israeli firm Discover-Tech operated an advertising platform, Controlium, that served as a bridge between ad buyers and the mercenary spyware ecosystem. According to Wired, the ads tied to that firm, carrying script tags, appeared in more than 70,000 mobile applications and more than 120,000 websites between March and June of this year.

The finding matters for Mexico because of a direct precedent. The country has a documented history of commercial spyware cases against journalists, human rights defenders and public officials, investigated in recent years by Citizen Lab and by press organizations. The three profiles that tend to be targets of these tools are also the ones that depend most on the phone as a work tool.

Details from the report:

  • Citizen Lab attributes the spyware distribution to the developers Candiru and Bindecy, both suppliers of zero-click products. - The ad auction records showed ads on networks belonging to NATO, the UN, the International Atomic Energy Agency and the International Criminal Court. - Google blocked Discover-Tech from its advertising platforms after a joint investigation with Citizen Lab and the security firm Confiant, and activated Safe Browsing warnings for sites linked to the group. - The European branch of the Interactive Advertising Bureau suspended the firm from its global vendor list after an audit. - Researcher Bill Marczak said an infected person would notice nothing and recommended turning off ad tracking or blocking ads.

The report leaves open the names of the governments that may have contracted the attacks, a detail Citizen Lab could not determine. The conversation to follow is regulatory: if ad networks tighten verification of their clients, that is the point where the vector closes or repeats.

This article was written with the assistance of artificial intelligence from verified sources and reviewed by a human editor before publication.