Citizen Lab’s AdFection report puts names to the apps in which an Israeli ad company’s spyware-linked ads were shown. On Android, MX Player and Lark Player each displayed such ads more than one million times between March and June 2026, and Viber about 700,000 times. Citizen Lab said an ad appearing in an app is not an infection, and it does not call any of these apps malicious.
The report has a second finding that matters to anyone who uses a VPN. Citizen Lab said some of the same ads tried to reveal a VPN user’s real IP address and the phone number of the person looking at the ad, by leaning on weak spots in how mobile carriers in more than 30 countries identify customers to websites.
The research, which Citizen Lab published on 15 October, centres on Discover-Tech, an Israeli firm that Citizen Lab says passes itself off as an ordinary ad company while acting as a bridge between ad networks and spyware vendors. Citizen Lab said at least 45 devices at Al Jazeera were attacked in 2024 and 2025 through ads, with the infections tied with high confidence to spyware from Candiru, which now trades as Integrity Labs. The attack needed no tap: showing the ad was enough.
Pakistan appears in the data, though it is not the main thread. Citizen Lab said the site whatmobile.com.pk showed more than 100,000 of the ads, and that the country came second by bids on the ads, at about 139 million, behind Yemen at about 457 million. A bid is an offer to show an ad, and the report says an impression does not by itself confirm infection. We covered the National CERT advisory on this technique when it came out.
From MX Player to Ludo STAR
Citizen Lab analysed nearly four billion bidding records that Discover-Tech left publicly readable, covering March to June 2026. It counted ads carrying the company’s script tag in 75,373 Android and iOS apps and 120,768 websites. Apps dominated: 76.7% of the bids were for in-app slots, against 23.3% for browsers.
| App (Android) | Approximate ads shown |
|---|---|
| MX Player | More than 1 million |
| Lark Player: Music Player & MP3 | More than 1 million |
| Viber | About 700,000 (about 200,000 on iOS) |
| Snap VPN | About 500,000 |
| Truecaller | About 500,000 |
| VivaCut – AI Video Editor | About 500,000 |
The list goes on in smaller numbers: Opera Mini, Yahoo Mail, the German weather app Wetter Online, Duolingo, WeMuslim, Period Calendar Period Tracker and games such as Bubble Shooter and Ludo STAR. Family-tracking and dating apps, including Location Share, Badoo and Grindr, showed the ads in the thousands. iOS apps showed fewer of them than Android apps.
Three limits apply to this table. The figures are global and each number counts ads displayed, not phones infected. And Citizen Lab does not accuse any app of being malicious or of knowing about the ads: it explains that an ad can carry its own code, which runs inside whichever app or page shows it, and that ads reach apps through real-time auctions run by ad networks.
Most of the time, nothing happens. Citizen Lab said the Discover-Tech server decides whether a viewer is a chosen target and, if not, sends back nothing. At least 718 million of the roughly 3.77 billion bids it studied were for ads that appeared to carry the script tag.
How an ad can learn your phone number
Some of the ads tried a known browser trick, the WebRTC IP leak, which can expose the real IP address of someone using a VPN or proxy. The same ads also tried to get hold of the viewer’s phone number, which the report calls the MSISDN.
That second attempt depends on what Citizen Lab calls zero-click login. Some carriers add a header carrying the customer’s phone number to plain, unencrypted web requests that pass through their mobile gateway, for sites on a chosen list, so that those sites can log the customer in without a password. According to Citizen Lab, the checks that decide which sites get the number are buggy in many places, and so are some outside services carriers hire for the job. The researchers grouped the flaws into five kinds and said attackers abuse them with carriers in over 30 countries, spread from the Americas to Africa and Asia.
A different attacker, which Citizen Lab calls DARK CARTOGRAPHER, ran this through Discover-Tech’s systems to match advertising IDs to phone numbers. The researchers believe it has been going on since at least 2019. This is the part to read carefully: the carriers have not been named, disclosure to them is still under way, and Citizen Lab said it will publish a further report once that ends.
Armenia to Australia: the wider map
The report lists the websites with the most of these ads by country, and the networks in which the ads were seen.
| Country | Site | Scale reported |
|---|---|---|
| Armenia | mamul.am | Above 1 million ads |
| Montenegro | dan.co.me and vijesti.me | Above 100,000 ads |
| Pakistan | whatmobile.com.pk | Above 100,000 ads |
| Serbia | kurir.rs | Above 1 million ads |
| Yemen | adngad.net | Above 100,000 ads |
| Not stated | Weather.com | Around 400,000 ads |
On the networks side, Citizen Lab found impressions on those of NATO and the United Nations, EU institutions including the Parliament and the Commission, plus government and utility networks in Norway, Sweden, Denmark and Australia. Its list of countries with ads on government-operated networks also includes Bhutan, Indonesia, Malaysia and Thailand; India is not on that list, nor in the report’s two top-ten country tables for bids, nor among the eight countries with media organisations affected. It also saw them at chipmakers such as Intel and Nvidia, at defence firms Raytheon and Elbit Systems, and at media organisations in eight countries. As with the apps, these are impressions: the report says each one calls for investigation, not that anyone was infected.
Beyond Candiru, Citizen Lab tied Discover-Tech to two more firms in the same trade, Bindecy and Intelos. Discover-Tech, Candiru, Bindecy and Intelos did not answer its requests for comment. Google and the ad industry body IAB Europe took Discover-Tech off their approved-vendor lists in early October 2026, and Beeswax, Eskimi and Vungle (Liftoff) also cut or paused its access.
Where the report places the people and servers
Citizen Lab reviewed login records for Controlium, the control panel Discover-Tech’s customers use, which were exposed through an unauthenticated endpoint, and fingerprinted Bindecy’s servers. The table gives the locations it reports. A login or server location shows where someone connected from. It does not say who is behind the connection or where anyone was attacked, and a location can be a VPN or proxy. Citizen Lab does not tie any of these places to a government.
| Who or what | Locations reported |
|---|---|
| Controlium user mi19mos25a, not tied to any company | Mostly India, occasionally Israel |
| Controlium user Pindi, not tied to any company | Pakistan only |
| Controlium user rcs1, not tied to any company | Only Italy, mostly one fixed address in Milan |
| Two Candiru-linked presale users | Azerbaijan, Czechia, Israel, Italy, Mexico, Montenegro, UAE, United States |
| Bindecy operators the researchers could locate | Belgium, Germany, Norway, Portugal, Sweden, Singapore, Spain |
| A customer that appeared to use Bindecy’s spyware | Mexico and Colombia; the operator’s location was not determined |
| Intelos-linked users not on a VPN or proxy | Belgium, Czechia, France, Greece, Hungary, Israel, Italy, Latvia, Macedonia, Poland, Portugal, Serbia, Singapore, Spain, Thailand, UAE |
India appears twice and Singapore three times. The first India entry is the unattributed user mi19mos25a, whom Citizen Lab could not tie to a company. Singapore appears as a location of some Bindecy operators and as one of four places (with Belgium, Israel and Poland) from which an Intelos-linked user called bear signed in. The other India mention and the third Singapore one come from Affle: Citizen Lab writes that Affle, an advertising group it describes as based in Singapore and India, bought Discover-Tech’s mobile device marketing business in 2021 through a Dubai unit. It says it has no reason to believe Affle controls the malicious ad operations, and Affle did not respond to its request for comment.
Other places turn up in the report’s account of the vendors. It cites press reports that Bindecy sold spyware to Italy’s Carabinieri and that Intelos technology was offered to Israel’s Shin Bet and sold in Thailand. A Thai businessman is among Intelos’s shareholders. Citizen Lab does not say what any of this means for the countries listed, and neither do we.
What Citizen Lab suggests for ordinary users
Citizen Lab’s own advice is modest: a trusted ad-blocking extension, a browser built to limit tracking, a regular reset of the phone’s advertising ID, ad tracking switched off, and the opt-out settings in apps. Filtering can also be set up on a home router or come with a VPN the user trusts. People at higher risk because of their work should seek expert help, it said, and news organisations should check their security logs.
No date has been given for the follow-up report on the phone-number attacks, which Citizen Lab said will come after the carriers have been told.
