The Consent

On Thursday, Citizen Lab at the University of Toronto published a report it calls AdFection. At least 45 devices at Al Jazeera, it found, were targeted in 2024 and 2025 with spyware it attributes "with high confidence" to Candiru, an Israeli spyware maker. The spyware arrived inside ordinary online ads. Nobody had to click. The ad loaded, sometimes out of sight, and that was enough.

The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal advertising firm. Between March and June 2026 it placed 3.77 billion bids and won 442 million auctions, on more than 75,000 apps and 120,000 websites.

From 2020 until early this month, Discover-Tech was on Google's approved vendor lists and on the Global Vendor List of IAB Europe's Transparency and Consent Framework. That framework sits behind a great many of Europe's cookie banners. Its job is to record whether you said yes.

(Consent took me several passes, and I think I have it now. Consent is a box that asks permission to show you relevant advertising. The advertising is then shown to you. What the advertising contains is a separate matter, and was never part of the question. The framework presumably recorded every yes correctly. It did not ask what the yes was for, because the yes was the product.)

Candiru was put on a US trade blacklist in 2021. Its assets were bought in 2025 and now sit in a company called Integrity Labs.

Google and IAB Europe removed Discover-Tech after the researchers got in touch. The banners are still there. They still offer two buttons. The attack never needed either of them.

Written 2026-10-16T21:56Z.