BleepingComputer and Hackread report that Citizen Lab confirmed AdFection as the first documented zero-click spyware delivery method using targeted online ads, linking it to Candiru spyware infecting 45 Al Jazeera Media Network devices between 2024 and 2025. Discover-Tech used its Controlium platform to profile, de-anonymize, and fingerprint devices using ad identifiers such as IP addresses and mobile ad IDs. The firm then embedded malicious JavaScript in ads, enabling the delivery of Candiru spyware without requiring users to click on anything.
Between March and June 2026, Discover-Tech placed 3.77 billion ad bids and won 442 million auctions. During the same period, its ads appeared on 75,373 Android and iOS apps and 120,768 websites.
Citizen Lab estimates that these ads exposed hundreds of thousands to millions of users, though only targeted devices experienced infection. The ads appeared on networks used by NATO, the UN, the European Parliament, the US Department of Defense, the International Atomic Energy Agency, and the International Criminal Court. Candiru spyware, linked to Integrity Labs, can extract messages, emails, photos, and device functions such as the microphone and webcam via zero-click exploits.
Previously, Candiru had been used to target over 100 journalists, dissidents, and activists across multiple countries. Discover-Tech’s Controlium platform exposed login credentials for employees of Candiru and Bindecy, confirming direct ties between the ad-tech firm and spyware vendors. Discover-Tech’s ads were used for large-scale tracking and reconnaissance, redirecting millions of users to Candiru servers.
In response to the findings, Google, IAB Europe, Beeswax, Vungle, and Eskimi revoked Discover-Tech’s access to their ad platforms. Al Jazeera condemned the spyware attacks as an assault on press freedom and called for accountability.
Join the discussion