---
title: Citizen Lab: 'AdFection' delivered zero-click Candiru spyware through targeted ads; Al Jazeera devices infected | ctxsec
url: https://ctxsec.com/items/citizenlab-adfection-candiru
description: ""
status: "confirmed (Citizen Lab research)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/citizenlab-adfection-candiru.md)

confirmed (Citizen Lab research)

2026-10-15

### Citizen Lab: 'AdFection' delivered zero-click Candiru spyware through targeted ads; Al Jazeera devices infected

Citizen Lab published a report on Oct 15 (co-timed with ad-security firm Confiant) that it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. It links, with high confidence, zero-click attacks on at least 45 devices at Al Jazeera in 2024–2025 to Candiru spyware (reportedly now owned by US-based Integrity Labs) delivered via ads bought by Israel-based Discover-Tech. Discover-Tech's Controlium platform profiles and de-anonymizes users from real-time-bidding data (ad ID plus IP); selected targets are later served malicious JavaScript that exploits the device, while the ads themselves carry no exploit code. Citizen Lab says ad-bidding records showed Discover-Tech ads reaching millions of devices, including impressions on NATO, EU institution, government, critical-infrastructure and media networks; it stresses an impression alone does not confirm targeting or infection. Google and IAB Europe removed Discover-Tech from their vendor lists, and Google and Beeswax cut off its access. Defender takeaway: ad blocking and limiting ad-ID tracking on high-risk staff devices is now a spyware control, not just privacy hygiene.

Sources: [Citizen Lab executive summary](https://citizenlab.ca/research/exposing-adfection-executive-summary/) · [Citizen Lab full report](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) · [CyberScoop](https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/)