Targeted Ads Delivered Candiru Spyware in a Zero-Click Attack Against Al Jazeera Devices

Targeted online ads delivered Candiru spyware to devices used by Al Jazeera Media Network in a zero-click attack. Victims did not need to click the ads; simply displaying a malicious ad on a device was enough to trigger the attack.

Researchers at Citizen Lab investigating the incident named the technique AdFection. They said their report provides the first public technical confirmation of mercenary spyware being delivered through targeted advertising.

A similar technique was documented by Amnesty International in late 2025. That campaign used ads to infect targets with Predator spyware without requiring them to click anything.

That infection mechanism, called Aladdin, emerged through leaked marketing files and documents from surveillance firm Intellexa. Researchers studied the material and corroborated it with technical details from forensic investigations.

Unlike Aladdin, AdFection was used in an actual attack. Citizen Lab associated the operation with Discover-Tech, an Israeli company it describes as “the bridge between mercenary spyware companies and the advertising ecosystem.”

How the Candiru zero-click spyware attack worked

According to Citizen Lab, Discover-Tech allowed customers to use the Controlium platform to target specific devices with malicious code. The platform could also profile, de-anonymize, and fingerprint user devices.

“Discover-Tech appears to be working with multiple spyware, hacking, and advertising vendors to connect the spyware industry to the online advertising ecosystem,” Citizen Lab says.

Discover-Tech purchased ad inventory through mainstream advertising networks and exchanges. The company embedded JavaScript in the ads, which connected to NOAS servers when the ads were displayed.

The NOAS, or “getAd,” server used multiple parameters—including an IP address and advertising identifier—to determine whether a device matched the intended target and was eligible to receive additional JavaScript code.

Only selected targets received the additional code. Other devices that displayed the same ad received nothing, helping keep the attack hidden.

At least 45 devices targeted with Candiru spyware

Al Jazeera provided Citizen Lab with evidence of attacks targeting at least 45 devices between 2024 and 2025. Network logs examined by researchers showed a chain of connections from Discover-Tech infrastructure to a Candiru verification server and then to the spyware’s command-and-control server.

Researchers also recovered a DLL file from a compromised Windows system. They confidently attributed the file to Candiru based on its infrastructure and code overlap with previously captured samples.

Candiru is an Israeli spyware vendor that officially sells surveillance tools only to governments. The company has also developed Windows malware called DevilsTongue, which can steal files, credentials, and messages.

According to previous reports, Candiru tools have been used against journalists, activists, politicians, and other targets through zero-day exploits affecting Windows and Chrome.

Malicious ads reached thousands of apps and websites

Although Al Jazeera devices were identified as targets, Citizen Lab reported that the advertising business received 3.77 billion bids and 442 million auction wins between March and June 2026.

Ads believed to contain the attackers’ script tag appeared across 75,373 Android and iOS apps and 120,768 websites. However, these figures do not represent the number of infections.

“We estimate that hundreds of thousands to millions of users were directed to these domains via Discover-Tech ads,” Citizen Lab explains.

Following Citizen Lab’s report, major advertising companies—including Google, IAB Europe, Beeswax, Eskimi, and Vungle—took steps to remove offending accounts and block access to the associated domains.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report