Online advertisements can now serve as a zero-click spyware delivery channel, according to a Citizen Lab investigation published Thursday. The University of Toronto research group said Israeli advertising company Discover-Tech used targeted ads to direct devices toward infrastructure operated by mercenary spyware vendors, including Candiru. It called the technique “AdFection,” describing the report as the first public confirmation of mercenary spyware delivered through targeted advertising. [6]
The attack does not require a victim to click an ad. When an ad renders, either visibly or in the background, its embedded JavaScript can contact a Discover-Tech server, submit advertising or device identifiers, and receive additional code if the user matches a selected target. That code can then retrieve browser exploits or other payloads. Citizen Lab said Discover-Tech’s Controlium platform supported targeting by mobile advertising ID, browser cookie and IP address, allowing operators to single out devices through the real-time bidding ecosystem.
The researchers linked the most serious documented incidents to Candiru spyware infections at Al Jazeera. Network logs from 2024 and 2025 showed at least 45 Windows devices contacting Discover-Tech infrastructure, then Candiru validator and command-and-control servers. Citizen Lab said it attributed the activity to Candiru with high confidence based on the infection sequence, persistence mechanism, code characteristics and network indicators. Candiru spyware can provide remote access to compromised systems and enable theft of data, microphone and camera access, and further surveillance. [12]
The operation was far larger than the Al Jazeera targeting. Citizen Lab analyzed nearly four billion Discover-Tech bidding records from March through June 2026 and found attacker-controlled script tags in at least 718 million bids. Those ads appeared across more than 120,000 websites and 75,000 Android and iOS applications in 161 countries, according to the report. The researchers also identified links to mercenary spyware company Bindecy, advertising-intelligence provider Intelos and a separate actor dubbed DARK CARTOGRAPHER, which they said used advertising infrastructure to connect device identifiers with phone numbers through weaknesses affecting mobile carriers.
No new CVE, CVSS score, public proof of concept or software patch has been identified for the AdFection campaign itself. The report discusses previously documented browser and Microsoft vulnerabilities associated with Candiru activity, but does not tie a specific current CVE or fixed product version to the Al Jazeera infections. Defenders should therefore treat malicious advertising and tracking infrastructure as an intrusion risk rather than rely solely on conventional patching: organizations should block ads and third-party tracking at gateways and managed devices, disable advertising identifiers where possible, monitor unusual ad-impression traffic, and investigate endpoint and network logs for suspicious Discover-Tech or Candiru-related connections.
Google said it removed Discover-Tech from its advertising platforms and vendor registries, while IAB Europe removed the company from its Global Vendor List; other ad-tech providers also suspended or blocked its access following the investigation. Citizen Lab said the case demonstrates that vendor certification and real-time bidding controls failed to prevent a surveillance operation from reaching sensitive networks, and urged regulators to investigate the companies and impose stronger due-diligence, auditing and data-governance requirements. [6]
References
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware – The Citizen Lab
- Israeli firm used online ads to run vast spy operation, …
