Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware

Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad system reached government networks.

Citizen Lab calls the technique AdFection and describes it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising.

At least 45 Al Jazeera devices were targeted during 2024 and 2025. According to the Citizen Lab investigation, network logs showed affected devices connecting first to infrastructure operated by Israeli advertising company Discover-Tech and then to servers linked to Candiru spyware.

Candiru, which Citizen Lab also associates with the name Integrity Labs, develops surveillance software capable of extracting messages, emails and photographs while accessing microphones and other device functions.

How AdFection Reaches a Target

Discover-Tech operated a campaign platform called Controlium that allowed customers to enter identifiers associated with a target, including an IP address or mobile advertising ID.

Billions of Advertising Records Exposed

Confiant observed Candiru-related handoffs at only hundreds to the low thousands of ad impressions per day in its dataset, a small fraction of Discover-Tech’s estimated daily traffic.

Although an ad impression confirms that a Discover-Tech ad reached the network, it does not prove that an employee was targeted or that a device was infected. Citizen Lab therefore said separate investigations would be required to determine whether any of those organisations experienced spyware attacks.

Google worked with the researchers and terminated Discover-Tech’s access to its advertising exchanges. IAB Europe removed the company from its vendor registry, while Beeswax removed it from its buying platform.

Vungle owner Liftoff paused Discover-Tech’s access pending a review, and Eskimi blocked its accounts and domains. Microsoft Advertising and Sunteng had not responded to Citizen Lab’s questions by the report’s publication deadline. Discover-Tech had not publicly responded to the allegations at the time of writing.

Blocking Ads Can Reduce Exposure