Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad system reached government networks.
Online advertisements requiring no clicks were used to deliver mercenary spyware to devices at Al Jazeera, according to new research from Citizen Lab and advertising security company Confiant.
Citizen Lab calls the technique AdFection and describes it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising.
At least 45 Al Jazeera devices were targeted during 2024 and 2025. According to the Citizen Lab investigation, network logs showed affected devices connecting first to infrastructure operated by Israeli advertising company Discover-Tech and then to servers linked to Candiru spyware.
Candiru, which Citizen Lab also associates with the name Integrity Labs, develops surveillance software capable of extracting messages, emails and photographs while accessing microphones and other device functions.
How AdFection Reaches a Target
Discover-Tech operated a campaign platform called Controlium that allowed customers to enter identifiers associated with a target, including an IP address or mobile advertising ID.
The platform could then buy advertising space through services connected to Google, Yandex, Beeswax, Vungle, Eskimi and other advertising companies. Discover-Techcould continue bidding until an advertisement reached the selected device.
When the advertisement loaded, embedded JavaScript contacted a Discover-Tech server called NOAS. Most devices received no additional code, although the advertisement could still collect information such as cookies and the device’s public IPv6 address.
A device selected for attack could be redirected to a Candiru validation server, which checked whether it matched the intended target and whether a suitable exploit was available. The spyware delivery process could begin without the person clicking or even noticing the advertisement, which could also load in the background.
Billions of Advertising Records Exposed
Citizen Lab’s research revealed that it recovered almost four billion ad-bidding records from publicly accessible Discover-Tech systems. Records covering March through June 2026 showed the company’s advertisements appearing on more than 120,000 websites and over 75,000 Android and iOS applications.
Confiant separately estimated that Discover-Tech was serving about 10 million advertisements each day. Its technical report found extensive collection of IP addresses, browser information, advertising identifiers and cookies.
Confiant observed Candiru-related handoffs at only hundreds to the low thousands of ad impressions per day in its dataset, a small fraction of Discover-Tech’s estimated daily traffic.
Advertisements Reached Sensitive Networks
Discover-Tech advertisements were recorded on networks belonging to NATO, the United Nations, the European Parliament and several European government agencies. Other recorded impressions involved Raytheon, Westinghouse, Intel, Nvidia, Apple, Microsoft and ARM.
Confiant also found signs that the advertisements appeared on networks used by the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court (ICC).
Although an ad impression confirms that a Discover-Tech ad reached the network, it does not prove that an employee was targeted or that a device was infected. Citizen Lab therefore said separate investigations would be required to determine whether any of those organisations experienced spyware attacks.
Discover-Tech Loses Access to Major Ad Platforms
Google worked with the researchers and terminated Discover-Tech’s access to its advertising exchanges. IAB Europe removed the company from its vendor registry, while Beeswax removed it from its buying platform.
Vungle owner Liftoff paused Discover-Tech’s access pending a review, and Eskimi blocked its accounts and domains. Microsoft Advertising and Sunteng had not responded to Citizen Lab’s questions by the report’s publication deadline. Discover-Tech had not publicly responded to the allegations at the time of writing.
Blocking Ads Can Reduce Exposure
Citizen Lab recommends blocking advertisements and tracking systems at organisational gateways and on work devices. Companies using mobile-device management can also disable or restrict advertising identifiers and personalised advertising.
People at increased risk of targeted surveillance can use a reputable content blocker, restrict advertising tracking and keep browsers and operating systems updated. Blocking advertisements can remove this delivery route, but it cannot protect against every method used by mercenary spyware operators.
