Citizen Lab and Confiant investigated AdFection activity in which Discover-Tech abused advertising technology to deliver spyware to targeted devices. Reporting by The Guardian and The Verge also covered the advertising-based attack path and responses from the companies involved. Billions of observed ad bids are not infection counts, and target identification must be distinguished from proof of compromise. Confiant’s technical analysis describes visitor identification and concealment, illustrating why application vulnerability management should be considered alongside advertising-supply-chain controls.