tl;dr: Citizen Lab documents the first confirmed case of zero-click mercenary spyware (Candiru/Integrity Labs) being delivered through targeted online ads, a technique they call "AdFection," which infected 45+ devices at Al Jazeera. The pipeline runs through Israeli ad-tech firm Discover-Tech, whose Controlium platform lets spyware customers de-anonymize, fingerprint, and infect specific users via ads served through legitimate exchanges like Google, Yandex, and Beeswax—reaching ~200,000 apps/sites across dozens of countries. Google, IAB Europe, Beeswax, Liftoff, and Eskimi have since cut off Discover-Tech's access following disclosure.