Summary
- Citizen Lab documents Candiru spyware infections at Al Jazeera delivered through targeted advertisements without user clicks.
- At least 45 Al Jazeera devices were targeted; millions of other devices contacting related infrastructure are not confirmed infections.
- Google and IAB Europe removed Discover-Tech from vendor programmes after the investigation; links to other exposed networks need separate investigation.
Devices at Al Jazeera were infected with Candiru spyware after targeted advertisements were displayed, according to a Citizen Lab investigation that traces the attack chain through the advertising company Discover-Tech. The researchers say no user click was needed for the documented infection method.
Citizen Lab calls the technique AdFection and describes it as its first public technical confirmation of zero-click commercial spyware delivered through online adverts. At least 45 devices at Al Jazeera were targeted in attacks during 2024 and 2025, but the figure is not a count of infections. The report identifies Candiru, now branded Integrity Labs, in the confirmed infection chain and links ad purchases to Discover-Tech.
Unlike phishing, this mechanism does not depend on a person responding to a message or selecting a malicious link. When an advertisement is displayed within a website or application, it can request JavaScript from infrastructure controlled by the advertiser. Citizen Lab found that Discover-Tech used the process to profile devices and decide whether to return malicious content. Most people shown an advert would not necessarily receive an exploit, making the activity harder to reconstruct from routine ad inspections.
Researchers combined network logs supplied by Al Jazeera, a sequence of contacts with Discover-Tech and Candiru infrastructure, and spyware analysis. That evidence supports their conclusion that particular broadcaster devices were infected through the advertising delivery path. Other impressions and server contacts lack the same corroboration; Citizen Lab did not reconstruct every individual exploit component used during the attacks or identify all parties that commissioned the surveillance.
The researchers also examined almost four billion advertising bidding records covering approximately four months. Discover-Tech adverts appeared across nearly 200,000 distinct websites and mobile applications in multiple countries, and millions of devices contacted associated infrastructure. Such records can show reach, selection or reconnaissance, but they do not establish that those devices were deliberately selected for infection, received exploit code, or were compromised.
The investigation has implications for European advertising intermediaries because real-time bidding distributes information about devices and users among multiple commercial participants. Advertising identifiers, network details, browsing context, and other signals can help an authorised advertiser select an audience. In this case, the researchers describe that same selection process being used to identify and reach surveillance targets.
Following disclosures from Citizen Lab, Google terminated Discover-Tech’s access to its advertising exchange, while IAB Europe removed the company from its approved-vendor listings. Other advertising intermediaries suspended or blocked access, according to their responses published in the report. Those steps document platform responses to the evidence; they do not establish that each intermediary knew of the spyware operation or that every advertisement placed by Discover-Tech carried malicious code.
Advertising-funded websites and applications can receive executable content through third-party ad delivery systems that are operated separately from a site owner’s normal software deployment. The researchers describe a mechanism that selects devices through advertising identifiers and network details, then returns code only under particular conditions. Common email and software-installation controls would not by themselves record all activity across that route.
The distinction between an ad being served, a device being selected for targeting, and a successful infection is particularly important for investigators reviewing networks. An organisation appearing in a bidding dataset may have been exposed to surveillance infrastructure without having experienced an intrusion. Al Jazeera’s logs supplied a more specific evidential trail, allowing researchers to associate advertisement activity with malware infections.
Google and IAB Europe’s removals are a concrete response to the advertising-system findings. Citizen Lab also found impressions from networks associated with government and international bodies, including European institutions. An impression on such a network cannot be described as a confirmed intrusion, nor did the researchers observe every exploit component involved in the Al Jazeera attacks. The higher-confidence cases depended on device and network evidence that was not available for the wider advertising population. Vendors now face questions about how code returned after an advertisement is approved can be independently assessed.
Al Jazeera provided network records that allowed investigators to test and confirm the documented spyware delivery chain. The research does not identify every purchaser of surveillance capabilities or establish whether devices elsewhere in the advertising dataset were infected. Further device-level investigation would be needed to resolve such suspected cases.
