Zero-click ads delivered Candiru spyware to Al Jazeera devices

Researchers at Citizen Lab say targeted online ads delivered Candiru spyware to devices used by Al Jazeera Media Network in a zero-click attack. The attack required only that a malicious ad render on a device; users did not need to click it.

Citizen Lab calls the technique “AdFection” and says its report is the first public technical confirmation of mercenary spyware delivered through targeted ads. Researchers linked the operation to Israeli firm Discovere-Tech and its Controlium platform, which could target devices and profile or identify them, according to the report.

The ads ran through mainstream advertising networks and exchanges. Embedded JavaScript contacted a server that assessed whether a device matched targeting criteria. Selected devices received more code, while other devices that displayed the ad received nothing, a design that researchers said helped keep the operation stealthy.

Al Jazeera provided evidence of attacks targeting at least 45 devices between 2024 and 2025. Researchers found network activity connecting Discovere-Tech infrastructure to Candiru validation servers and then to spyware command-and-control servers. They also recovered a Windows DLL that they attributed to Candiru with high confidence.

Citizen Lab reported that the advertising operation placed 3.77 billion bids and won 442 million auctions between March and June 2026. Ads assessed to contain attacker scripts appeared in 75,373 Android and iOS apps and 120,768 websites; those figures are not infection counts. The researchers estimated that hundreds of thousands to millions of users were directed to related domains. Google and other advertising companies removed accounts and blocked domains after receiving the report.