Citizen Lab reported on Oct. 15 that Candiru spyware reached devices at Al Jazeera through online ads that needed only to render on screen, with no click from the target. The researchers named the technique AdFection and call it the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads. At least 45 Al Jazeera devices were targeted in 2024 and 2025.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The report is Citizen Lab Report 195 from the University of Toronto, titled “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.” Its authors are Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, and it pins the delivery on an Israeli ad company, Discover-Tech, rather than on any one ad network.
How an ad auction becomes a delivery system
As laid out in the Citizen Lab report, Discover-Tech wins an ad auction and the ad renders on a user’s device. The ad contacts a Discover-Tech server the researchers call NOAS, which receives advertising identifiers and decides whether the target is eligible. An eligible device gets JavaScript back; every other device gets an empty response, a design that keeps malicious code away from the ad sellers and the ordinary audience. BleepingComputer’s account adds that the attack required only rendering the malicious ads on the victim’s device.
Discover-Tech presents itself as a legitimate advertising company, but the report says it works as a facilitator for several spyware and surveillance partners. Citizen Lab described it as “a bridge between mercenary spyware companies and the advertising ecosystem.” Its Controlium platform let customers target users by mobile ad ID, browser ID or IP address and run controlled ads, and administrators could restrict customers by country, domain, app and campaign volume. Authentication flaws in the platform let the researchers see login logs, and an unauthenticated endpoint exposed 128 days of logs and 120 usernames; the authors say they did not attempt to exploit the weakness. The report also links Discover-Tech to other vendors, including Intelos, which works in advertising-based intelligence, and Bindecy, along with a separate actor called DARK CARTOGRAPHER that ties advertising IDs to phone numbers and will be covered in a forthcoming report.
The Al Jazeera evidence behind the Candiru attribution
Al Jazeera Media Network supplied network logs showing a sequence from contact with Discover-Tech infrastructure, to a Candiru validator server, to a Candiru command-and-control server. A malware sample recovered from an affected device matched Candiru’s 2021 attack chain, which the authors assess with high confidence, and fingerprinting turned up 305 validator domains. The report says Candiru, now rebranded as Integrity Labs, is the vendor behind the spyware. BleepingComputer notes that the recovered file was a DLL from a compromised Windows system and that the coverage does not identify a specific exploit.
Candiru is not new to Citizen Lab. Its July 15, 2021 report described a secretive Israel-based company that sells spyware exclusively to governments and tied more than 750 websites to its infrastructure. Microsoft’s July 15, 2021 analysis tracked the actor as SOURGUM, identified more than 100 victims including politicians, activists, journalists and dissidents, and said two Windows privilege-escalation flaws that Candiru exploited were fixed in the July 2021 updates, and Google reported Chrome zero-days that Citizen Lab linked to the same vendor. BleepingComputer adds that Candiru developed DevilsTongue, Windows malware that can steal files, credentials and messages, and that its tools were previously deployed through Windows and Chrome zero-day exploits against journalists, activists and politicians.
Billions of bids and the industry’s response
The scale figures come from about four billion bidding records covering four months. The Discover-Tech buyer bid on about 3.77 billion impressions and won about 442 million, or 11.7 percent, and ads with malicious script tags appeared in 75,373 apps and 120,768 websites, including on the networks of governments, defense bodies, NATO, the United Nations and the European Union. Citizen Lab stresses that these impressions do not confirm infections and that its data covers only part of Discover-Tech’s activity.
Discover-Tech was an approved vendor with Google and IAB Europe and used GDPR consent frameworks, which the report treats as evidence that the ad system failed to detect the abuse. Google and IAB Europe removed it from their vendor registries in early October 2026, and Google ended Discover-Tech’s access to its ad exchanges. Beeswax removed Discover-Tech from its platform, Vungle, part of Liftoff, paused access during a review, and Eskimi blocked its accounts. Other vendors did not respond within the report’s timeline. BleepingComputer adds that Citizen Lab said hundreds of thousands and even millions of users were directed to the relevant domains through Discover-Tech ads, a figure that measures exposure to the ads and not confirmed infections.
The technique differs from an earlier method called Aladdin, which Amnesty International documented in late 2025 delivering Predator spyware and which was studied through files leaked from Intellexa; The Hacker News reported on Dec. 5, 2025 that Aladdin works by forcing a malicious advertisement created by the attacker to be shown on the target’s phone. AdFection was observed in real attacks and tied to a specific firm, which is what makes the Al Jazeera case a documented incident rather than a demonstration of what is possible.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
