Researchers at Citizen Lab have documented the first publicly confirmed case of mercenary spyware delivered through targeted online advertisements without requiring a click. The technique, called AdFection, was used to infect devices at Al Jazeera with Candiru spyware.
At least 45 devices at the news organization were targeted during 2024 and 2025. Researchers linked the attacks with high confidence to malicious advertisements purchased by Discover-Tech, an Israeli company that Citizen Lab says facilitated operations for multiple surveillance vendors. The researchers confirmed infections but did not establish that all 45 targeted devices were compromised.
Real-time ad auctions process hundreds of billions of bids daily. According to Citizen Lab's Oct. 15 investigation, that infrastructure was used to profile millions of users and silently deliver spyware to selected targets.
What is the AdFection zero-click spyware attack?
AdFection exploits the way online advertising systems deliver content to browsers and apps.
When a Discover-Tech ad loads, embedded code contacts the company's servers and sends information that can include advertising identifiers, cookies, and the device's IP address.
If the device matches an intended target, the server can return malicious JavaScript that executes within the browser or app and delivers an exploit. Most devices receive no malicious code, although their information may still be collected.
The user does not have to click the ad, download a file, or approve an installation. In some cases, the advertisement can render in the background without being visible.
Previous zero-click spyware attacks have exploited messaging platforms. AdFection instead uses the advertising systems already embedded in websites and apps.
Citizen Lab calls this the first public technical confirmation of spyware infection through targeted advertisements, not proof that such attacks have never occurred before.
The scale of the delivery system extends well beyond Al Jazeera.
Researchers analyzed nearly four billion Discover-Tech bidding records covering March through June 2026. The records showed its ads appearing across more than 120,000 websites and 70,000 mobile apps in dozens of countries.
An ad impression alone does not confirm targeting or spyware infection. Citizen Lab says these impressions indicate exposure to Discover-Tech's profiling infrastructure, while actual exploitation requires additional evidence.
How targeted ads delivered Candiru spyware to Al Jazeera
Citizen Lab confirmed that Al Jazeera devices were infected with spyware associated with Candiru, a commercial surveillance vendor now operating under the Integrity Labs name.
The investigation relied on network logs provided by Al Jazeera, which allowed researchers to reconstruct the infection sequence.
Affected devices first contacted Discover-Tech infrastructure when an advertisement loaded. They then connected to a Candiru validation server, which checked the device before further profiling and infection.
Successfully infected devices subsequently communicated with Candiru command-and-control servers.
Those successive connections helped researchers identify the relationship between the advertising system and spyware delivery.
The distinction between targeting and infection remains important. Citizen Lab identified at least 45 targeted devices, but its published findings do not establish that every targeted device was infected.
Candiru has an established history of supplying surveillance technology to governments.
In November 2021, the US Commerce Department added Candiru to its Entity List over evidence that its spyware had been used to target journalists, officials, activists, and other individuals.
Citizen Lab also previously documented Candiru operations against civil society organizations. The company later adopted the Integrity Labs name following a reported acquisition by US-based Integrity Partners.
The Al Jazeera case establishes that this surveillance technology was delivered through ordinary advertising infrastructure rather than a malicious link sent directly to a target.
Inside Discover-Tech's Controlium platform
Citizen Lab describes Discover-Tech as an advertising company that provided a connection between legitimate ad exchanges and commercial spyware vendors, including Candiru, Bindecy, and Intelos.
Its Controlium platform allowed customers to select targets using identifiers such as IP addresses, mobile advertising IDs, and browser cookies.
Partners could then configure advertisements that retrieved additional code only when displayed to selected devices.
The researchers found that Discover-Tech used advertising infrastructure associated with Google, Yandex, Beeswax, Vungle, and Eskimi.
The platform's design helped conceal malicious activity from the services delivering the ads. An advertisement submitted to an exchange did not necessarily contain the exploit itself. The malicious code could instead be supplied later by Discover-Tech's servers.
In a separate technical investigation published alongside Citizen Lab's report, advertising security firm Confiant identified sophisticated device fingerprinting, encrypted command channels, and mechanisms for delivering code to selected users.
Confiant also found that some advertisements collected first-party website cookies, including session identifiers, under conditions where browser security restrictions allowed that access.
The operation reached sensitive networks.
Citizen Lab identified Discover-Tech ad impressions associated with NATO and UN networks, European Union institutions, government agencies in Denmark, Norway, and Sweden, and organizations involved in defense and nuclear research.
Researchers also observed impressions on networks associated with major technology companies.
These findings do not establish that any of those organizations were compromised. Network-level advertising records cannot identify every individual who received an ad or prove that spyware was installed.
Citizen Lab says a separate actor, designated DARK CARTOGRAPHER, used Discover-Tech infrastructure to connect advertising identifiers with phone numbers by exploiting vulnerabilities in mobile networks. Additional findings are expected in a later report.
How the advertising industry responded
Citizen Lab found that Discover-Tech had appeared on approved or certified vendor lists maintained by Google and advertising industry association IAB Europe.
Those registrations helped the company participate in advertising systems at scale despite corporate links to surveillance industry figures that researchers say were publicly discoverable.
Following the investigation, Google terminated Discover-Tech's access to its advertising exchanges and removed the company from its vendor registries.
Google also told Citizen Lab that it deployed Safe Browsing protections for known domains associated with the operation.
IAB Europe removed Discover-Tech from its Global Vendor List on Oct. 8.
Beeswax removed the company from its advertising platform after independent security validation. Vungle, owned by Liftoff, paused its access while reviewing the findings.
Eskimi blocked Discover-Tech's accounts and associated domains. In its response to Citizen Lab, Eskimi said the company's advertising tags delivered different code depending on the device, IP address, and location, allowing some campaigns to evade automated scanning.
The investigation exposed weaknesses in the vetting systems used by advertising companies. Existing malvertising threats have demonstrated how ad networks can distribute malicious content, but AdFection adds surveillance-driven targeting and zero-click exploitation.
What's confirmed, and what isn't
Citizen Lab has high confidence that Candiru spyware infected Al Jazeera devices through Discover-Tech advertisements.
What researchers have not established is which government commissioned those attacks or how many of the millions of profiled devices were successfully compromised.
Advertising impressions observed on sensitive networks are evidence of exposure and potential profiling, not confirmation of spyware infection.
Citizen Lab is calling on regulators to investigate whether Discover-Tech and Candiru violated applicable laws and to strengthen oversight of the advertising industry.
For organizations, the researchers recommend blocking advertising and tracking at network gateways and on managed devices where practical. They also advise restricting advertising identifiers through mobile device management policies.
People at elevated risk should consider trusted ad blockers, disable personalized ad tracking where possible, and keep devices updated. These measures can reduce exposure but cannot guarantee protection against every zero-click exploit.
Security teams should also preserve relevant network and endpoint evidence when investigating suspected infections. Newer capabilities such as Android's spyware intrusion logging can assist investigations, although they do not directly prevent AdFection-style delivery.
The Al Jazeera findings demonstrate that a device can be compromised through an advertisement the user never interacted with. Preventing similar attacks will require stronger scrutiny of the advertising infrastructure that delivers code to browsers and apps.
Also read: The recent DarkSword iPhone spyware investigation documented threats targeting sensitive device information, including Keychain credentials and cryptocurrency wallet data.