CLICKBREACH

Citizen Lab · Exposing AdFection · Oct 15, 2026

CLICKBREACH

You didn't click. It didn't matter.

Request access → Read the report
The attack · 0:46
SCANNER0traces flaggedmove your cursor to scan

For the first time, researchers caught mercenary spyware infecting devices through ordinary targeted ads. An ad loaded, and if you were the target, you were in. We're building the offline, read-only scanner that looks for the traces. in development · request access by DM

~4Bad bidding records on an exposed Discover-Tech server
120,768websites served ads with the attacker's script tag
75,373Android and iOS apps, same script
45devices at Al Jazeera targeted, 2024–2025
24countries whose government networks saw the ads

Source: Citizen Lab, Exposing AdFection (Marczak, Christl, Scott-Railton, Perry, Anstis, Deibert), Oct 15 2026. Bidding data covers Mar–Jun 2026.

01 · The attack

How an ad becomes an infection

Every time a page with ads loads, an auction runs in about a tenth of a second. Your device is described to bidders, and the winner gets to put code on your screen. AdFection used that auction as a targeting system.

  1. 1

    The auction

    A normal-looking targeted ad is placed through real-time bidding on a site or app you already use: weather, news, mail, dating, a language app.

  2. 2

    The profile

    Your ad identifier and IP address reach Discover-Tech's servers. It can link you across identifiers using IP and mobile advertising ID.

  3. 3

    The selection

    If you're the person they want, the ad slot delivers malicious JavaScript. Everyone else gets a boring ad. The ads themselves carry no exploit, which hid them from the platforms.

  4. 4

    The infection

    Your browser or app runs the code, the exploit fires, and the device is compromised. On Windows, the sample Al Jazeera recovered was a DLL that persisted through a COM hijack.

Live simulation · runs in your browser

Run the auction on yourself

// press "Run auction" to build the bid request
// your browser would describe you to bidders with
DSP · retail—
DSP · travel—
DSP · finance—
"one-stop platform"—

The real auction takes ~100 ms. You'd never see it.

Illustration only: the bidders are fictional and nothing leaves this page. The fields are the real values your browser exposes right now.

02 · Your exposure

What an ad auction can see about you

Computed locally from what your browser already hands to every page. This site has no analytics, and its security policy blocks it from sending data anywhere.

Ad blocker checking…

We test with a harmless decoy element that ad blockers usually hide.

03 · Reach

Where Discover-Tech's ads showed up

Networks where Citizen Lab saw Discover-Tech ad impressions. In the report's words: A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware. It shows how far the pipe reached.

International

  • NATO
  • United Nations
  • European Parliament
  • European Commission
  • Council of the EU General Secretariat

Tech & defense

  • Intel
  • Nvidia
  • Apple
  • Microsoft
  • ARM
  • Broadcom
  • Micron
  • Texas Instruments
  • Motorola
  • Raytheon
  • Elbit Systems
  • Westinghouse Electric

Nordics

  • Norwegian Parliament (Stortinget)
  • Norwegian Police, Kripos
  • Swedish Armed Forces
  • Svenska Kraftnät, Vattenfall
  • Saab, Volvo Group
  • Vestas, Ørsted, Grundfos
  • Copenhagen Airports

Elsewhere

  • Government networks in 24 countries
  • Election bodies in Armenia, Indonesia, Mexico
  • Australian grid & power firms
  • ANSTO, Australian Synchrotron
  • 19 media organizations

Discover-Tech

Israel-based firm presenting as an ad company. Citizen Lab found no evidence of legitimate advertising. Its platform, Controlium, is described as a one-stop shop for spyware firms to infect targets through ads.

Candiru

The spyware vendor tied, with high confidence, to the infections at Al Jazeera. On the US Commerce Department's Entity List. Bindecy and Intelos were also linked to Controlium.

The fallout

Google and IAB Europe removed Discover-Tech from their certified vendor lists. Google and Beeswax cut its access to their ad systems. Apps in the data included Duolingo, Yahoo Mail, Viber and Truecaller.

04 · The scanner in development

Look for the traces. Offline.

A small, standard-library-only Python scanner that checks your own computer against published indicators: file hashes, domains, IPs and filenames from Citizen Lab, Amnesty and the MVT project. Request access and builds go out by DM as they land.

Never contacts an indicator

A network guard is installed before anything runs. Looking up a spyware server would tell its operator they'd found a possible victim.

Read-only

It changes nothing. The only writes are temporary copies of locked databases, deleted after, plus the report you ask for.

A gap is not "clean"

If a check can't run (file locked, log disabled), it says so. "Couldn't check" and "found nothing" are never merged.

Every hit is graded

A file with a spyware sample's exact hash is conclusive. A domain mentioned in a saved article is not. The grade drives the verdict, not the count.

Evidence ladder

Hover a grade. Strongest first.

  1. on-diskfingerprint of a published sample
  2. on-devicea named artifact is present
  3. persistenceset to auto-start
  4. ran-commanda command naming it ran
  5. execution-recordPrefetch says it ran
  6. inventory-recordAmcache lists it
  7. contactedyour device talked to it
  8. dns-recorda lookup was recorded
  9. attemptedblocked on the way out
  10. configuredsitting in config
  11. referencedmentioned, not contacted

Ads are sub-resources inside iframes, so a real ad impression never shows in browser history. It survives only in caches, cookie stores and site storage, and those expire within weeks.

Windows · no admin

  • File hashes in user, app and temp folders
  • Hosts file, DNS resolver cache
  • PowerShell log & PSReadLine history
  • Win+R run box ("paste this to verify you're human")
  • Defender history & exclusions
  • Run/RunOnce, services, Startup items, per-user COM
  • Prefetch, Amcache, Mark of the Web

Browsers

  • Chrome, Edge, Brave, Opera, Vivaldi, Arc
  • Firefox, LibreWolf, Tor; Safari on macOS
  • History, cookies, HSTS, downloads
  • Caches & site storage, where ad traces live
  • Synced history graded down to "referenced"

macOS · Linux

  • LaunchAgents / LaunchDaemons
  • systemd units, cron, autostart
  • Shell history & startup files
  • Hosts file, readable system logs
clickbreach · report preview (illustrative)

  


  
Method studied from the open-source Zero Breach toolkit (Apache-2.0) and the Mobile Verification Toolkit. Written from scratch. Not affiliated with either. If you need a scanner today, use theirs: pin a tagged release and check its SHA-256. Never use "one-click installer" re-uploads of security tools.







  

    
05 · Protect yourself today

    
You don't need a token to do this

    
Citizen Lab's own advice centers on one thing: stop letting targeted ads reach you.

  

  

    
01
Block ads
Use an ad-blocking browser like Brave, or uBlock Origin in Firefox. Organizations can block targeted ads at the network gateway.

    
02
Update everything
Zero-click exploits target unpatched browsers and OSes. Turn on automatic updates and restart when asked.

    
03
Harden if you're high-risk
Journalists, activists and officials: iPhone Lockdown Mode, Android Advanced Protection, Google's Advanced Protection Program.

    
04
Suspect targeting? Get help first
Before running any tool, contact the Access Now Digital Security Helpline or Amnesty's Security Lab.

  







  

    
06 · They said it first

    
Receipts

  

  

    
      
"zero-click mercenary spyware hacking via targeted ads. A normal-looking ad loads. If you're a target, you're infected. No click needed. To protect yourself, block ads now."

      John Scott-Railton · Citizen Lab · Oct 15, 2026
    
    
      
"New research by Citizen Lab reveals zero-click spyware delivered through targeted ads. They call it "AdFection." Just viewing an ad can be enough to infect a device."

      Brave · Oct 17, 2026
    
    
      
"Everyone should block ads."

      John Scott-Railton · April 2024, two years early
    
  

  
Quoted, not endorsed. None of these people or organizations are involved with $BREACH.







  

    
07 · Token

    
$BREACH

    
A memecoin for a narrative that should be louder: the ads you scroll past are a delivery system. Holding it gets you nothing but the meme. The scanner will be free.

    
    

      Request access
      X
    

  

  

    

      
Ticker
$BREACH

      
Chain
Solana · pump.fun

      
Scanner
Free, open source, in development

      
Payouts
None

      
Promises
None

    

  







  
08 · FAQ
Questions

  

    
Is the scanner live?
Not yet. It's in development, and early builds go out to people who request access. The design and coverage on this page are the plan. We'll post the repo when it's public.

    
Was I infected?
Almost certainly not: AdFection was targeted, and most people who saw these ads got a normal ad. But the point stands: you'd never have known. Block ads either way.

    
Will a clean scan prove I'm safe?
No. No scanner can. It finds only published indicators in places that can still be checked, and many traces expire within weeks. Mercenary spyware is built to beat this kind of check.

    
Are you Citizen Lab, Brave or Zero Breach?
No. We're an anonymous team that read the report and built a memecoin around it. Everything on this page cites its source.

    
Does the token pay anything?
No. It's a memecoin. No payouts, no yield, no promises.