A zero-click attack leveraging targeted online advertisements infected systems at Al Jazeera Media Network with Candiru spyware. The malicious code executed simply by rendering the ads on victim devices, with no clicks necessary. Citizen Lab researchers investigating the campaign dubbed the technique AdFection and published the first public technical confirmation of mercenary spyware delivered via this advertising vector.
The discovery follows a similar 2025 incident documented by Amnesty International involving Predator spyware distributed through ads under a method called Aladdin. That technique surfaced after researchers analyzed leaked marketing files and documents from surveillance company Intellexa and cross-referenced them with forensic evidence. However, AdFection differs in that it was caught during active attacks and traced to Israeli firm Discover-Tech, which Citizen Lab describes as "a bridge between mercenary spyware companies and the advertising ecosystem."
Zero-click Candiru spyware infection
Discover-Tech operated through its Controlium platform, enabling customers to target specific devices with malicious code or to profile, deanonymize, and fingerprint user devices. According to Citizen Lab, "Discover-Tech appears to work with multiple mercenary spyware, hacking, and advertising vendors, connecting the spyware industry to the online advertising ecosystem."
The firm purchased ad placements across mainstream ad networks and exchanges, embedding JavaScript within advertisements that contacted its "NOAS server" upon rendering. The server used multiple parameters—including IP address and ad identifiers—to determine whether a given target qualified to receive additional JavaScript code. Devices belonging to selected targets received the malicious payload, while other systems where the ad appeared received nothing, a mechanism that helped maintain operational secrecy.
Citizen Lab examined network logs from Al Jazeera showing attacks targeting at least 45 devices between 2024 and 2025. The logs documented traffic flowing from Discover-Tech infrastructure through Candiru validation servers to spyware command-and-control infrastructure. Researchers also recovered a DLL file from a compromised Windows system, attributing it with high confidence to Candiru based on infrastructure and code similarities with previously obtained samples.
Candiru, an Israeli surveillance vendor, officially sells its tools only to government customers. The company has also developed Windows malware called DevilsTongue, capable of stealing files, credentials, and messages. Historical reporting indicates its tools have been deployed through Windows and Chrome zero-day exploits against journalists, activists, politicians, and other targets.
While Al Jazeera represents one confirmed target, the advertising operation's scale was substantial. Between March and June 2026, Discover-Tech placed 3.77 billion bids and won 442 million auctions. Ads carrying attacker script tags appeared across 75,373 Android and iOS applications and 120,768 websites, though these figures do not directly correlate to infection counts.
Citizen Lab estimated that "between hundreds of thousands and millions of users were directed to these domains via Discover-Tech ads." Following notification of the research, major advertising platforms including Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked access to associated domains.