An ad appears on your screen. You don't click it. Doesn't matter. Spyware is already inside your device. Citizen Lab just published the first documented proof. Called it AdFection. An Israeli ad-tech company called Discover-Tech ran the operation. Controlium is their platform. Here's how it works. Ad network profiles you. Uses your advertising ID. Your IP address. Your cookies. Builds a fingerprint. Then Controlium serves a targeted ad. The moment the ad loads. Not clicked. Just rendered. The device makes a connection to Discover-Tech servers. Which immediately connects to Candiru spyware servers. Exploit fires. Spyware installs. You never knew the ad existed. Al Jazeera was the confirmed target. 45 journalist devices. Infected between 2024 and 2025. Controlium had a list of IP addresses and ad IDs that matched their staff. Served them invisible ads. Which delivered invisible spyware. Discover-Tech's ads appeared on 120,000 websites. 75,000 apps. 10 million impressions per day. Across 161 countries. Reaching NATO. The UN. EU institutions. US Department of Defense. All potential targets. Google certified Discover-Tech for six years. Listed them as an approved vendor. Didn't catch anything. Only cut ties after Citizen Lab published. citizenlab.ca/research/expos… The ad network was the spyware delivery system. No one was monitoring it because ad networks aren't supposed to do this. So no one thought to look.