Your free apps aren't the problem: the ad SDK inside them is

What if the most dangerous thing in your phone isn't an app you installed, but the ad that a free app shows you for half a second? That is the uncomfortable question behind the latest Citizen Lab report, and we think it deserves more attention than the usual "be careful what you click" advice. Here, nobody clicks anything.

What happened: an ad company that doubled as a spyware bridge

On October 15, researchers at Citizen Lab, at the University of Toronto, published a report on a technique they call AdFection. They describe it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads. The Israeli firm Discover-Tech, through its Controlium platform, allegedly profiled and deanonymized users, then let spyware vendors infect chosen targets when an ad appeared.

According to Wired, Citizen Lab concluded that 45 Al Jazeera devices were targeted in 2024 and 2025. The same report says ads linked to the firm, with attacker script tags, appeared in more than 70,000 mobile apps between March and June this year.

The problem is the architecture, not one bad actor

It's tempting to file this as a story about one shady company. Citizen Lab's own description points the other way. An ad is not just an image: it can carry code from the advertiser and other intermediaries, and that code runs inside the app or browser. Add real-time auctions that share device data, and anyone who wins the bid can address a single person's screen. As researcher Bill Marczak put it to Wired, until this architecture changes, or ad companies get serious about customer vetting, we'll keep seeing this kind of abuse.

That is the key point for anyone who uses free apps. Every ad SDK is a door that the developer opens to third parties, and the developer rarely controls what comes through it. A free app doesn't need to be malicious or even badly coded to become the delivery route. In our view, "this app is trustworthy" has stopped being a meaningful statement when the monetization layer is outsourced to an auction.

The gatekeepers failed, and that should change the rules

The most damning detail isn't technical. Citizen Lab says Discover-Tech appeared on lists of certified and approved ad vendors kept by Google and IAB Europe from 2020 until 2026. Researcher Wolfie Christl called it disastrous that major ad vendors apparently couldn't detect or prevent this for years.

To be fair, the reaction was quick once the evidence surfaced. Google told Wired it blocked Discover-Tech from its ad platforms, and IAB Europe suspended it from its vendor list. But a cleanup after a public report is not a control. We'd say the burden should shift: if a platform lets a vendor deliver executable code to millions of phones, vetting that vendor is a security duty, not a marketing checkbox. Regulators, as Christl urged, should look at the systemic risk and not just at one name.

One caveat keeps this honest. Cybersecurity analyst Eddy Willems told Al Jazeera that running code in a browser doesn't automatically give full control of a device, because an attacker may need a second vulnerability to escape the sandbox. And the documentation describes a targeted operation, not a mass infection of ordinary users. Most readers are probably not the target here. Still, the same pipeline profiles millions of people before choosing a few.

What to do about it

For users, the options are blunt: Marczak notes there isn't much people can do other than block ads as thoroughly as possible on every site and platform. Our recommendation: use content blockers where you can, keep your system and browser updated, and consider paying for the apps you rely on most, since an ad-free tier probably shrinks this attack surface. If you're a journalist, activist or work in government, treat ad blocking as basic hygiene, not paranoia.

For platforms, the verdict is clearer. Ad SDKs should be audited and sandboxed like any other third-party code, and vendor certification should mean something. "Free" apps were never really free. This report suggests the bill can include your device's security.