Citizen Lab Confirms Mercenary Spyware Delivered via Targeted Ads to 45 Devices Without Clicks

Security researchers at Citizen Lab have confirmed the first public instance of zero-click mercenary spyware being delivered through targeted online advertisements. The operation, dubbed "AdFection," successfully compromised devices at the news organization Al Jazeera with Candiru spyware. The campaign relied on an Israeli ad-tech company named Discover-Tech to purchase and serve the malicious ads. This method allows attackers to infect targets without any interaction, such as clicking a link or opening an attachment, making detection significantly harder for standard security tools.

In plain English

The attack exploits how digital advertising works to deliver malware silently. When a user visits a website or app, an auction happens in less than a second to decide which ad to show. Attackers can bid on specific people by using their device IDs, IP addresses, or location data. If they win the bid, their ad displays on the screen. In this case, the ad contained hidden code that ran automatically in the background. The code checked if the viewer was a target. If they were, it downloaded spyware. If not, nothing happened. The victim never saw anything unusual and did not need to click anything.

The background

Citizen Lab linked the 2024–2025 attacks to Candiru, now rebranded as Integrity Labs, with high confidence. The campaign targeted at least 45 Al Jazeera devices. Network logs showed a consistent pattern: the device first contacted Discover-Tech infrastructure to record the ad impression, then connected to a Candiru validator server for an initial check, and finally reached a Candiru command-and-control server. A Windows DLL recovered from a compromised device hardcoded C&C servers fearevolve[.]com and jobmarcher[.]com. It used a COM hijack for persistence and obfuscated strings with a 48-byte repeating XOR key, matching Candiru’s 2021 chain.

What changes now

Discover-Tech runs a platform called Controlium, which allows customers to select victims by mobile ad ID, cookie ID, or IP address. The researchers found weaknesses in this platform, including a misused Auth0 implementation that could allow token forgery. An unauthenticated endpoint exposed login logs, enabling Citizen Lab to retrieve 128 days of data covering 120 usernames. Almost four billion bidding records showed Discover-Tech ads on nearly 200,000 websites and apps over four months. These ads pushed millions of devices to contact Candiru servers, likely for tracking and reconnaissance, despite the firm appearing on certified vendor lists from Google and IAB Europe.

What made it possible

This incident highlights the risks of real-time ad bidding systems that expose detailed device identifiers. Security teams usually monitor for unusual outbound connections from browsing applications, as these can indicate silent data exfiltration. Check whether your organization’s network policies restrict ad-related traffic from critical endpoints. Ensure that mobile and desktop environments are isolated from sensitive data where possible. Review authentication mechanisms for any third-party platforms your team uses, as weak identity management can expose user lists and activity logs to attackers.

What to do and how to stay safe: Candiru

• Monitor network traffic for unexpected connections to advertising infrastructure or unknown command-and-control servers from browsing applications.
• Verify the security posture of any third-party ad-tech or analytics platforms your organization uses, ensuring they enforce strong authentication.
• Segment high-value devices from general internet browsing to limit exposure to drive-by exploits and ad-based delivery mechanisms.
• Review access logs for any vendor platforms to detect unauthorized access or data exposure, such as leaked user credentials or activity records.

Step-by-step guide: Ransomware Explained: How File Locking Works and What to Do

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AdFection?

AdFection is the name given by Citizen Lab to a technique where zero-click mercenary spyware is delivered through targeted online advertisements.

Which spyware was used in the Al Jazeera attack?

The attack used Candiru spyware, which is now rebranded as Integrity Labs, to compromise at least 45 devices.

How did the attackers target specific individuals?

Attackers used real-time ad auctions, bidding on specific device IDs, IP addresses, and location data to serve malicious ads to chosen targets.