Spyware delivered through ads, no click needed: Citizen Lab exposes real-world attack on Al Jazeera
The lab calls the technique “AdFection.” Ads from the company behind it showed up on government networks in more than 20 countries.
The ad only had to load. Citizen Lab, the University of Toronto's digital security lab, published a report on Thursday, October 15, that it describes as the first technical demonstration of zero-click mercenary spyware delivered through targeted advertising in real attacks. The researchers concluded with high confidence that devices at the Al Jazeera media network were targeted and infected with spyware from Israeli vendor Candiru.
How the attack works
The report calls the technique “AdFection.” At its center is Discover-Tech, an Israel-based company that presented itself as an ad business. It bought placements in real-time bidding auctions, the system that decides in milliseconds which ad appears in a website or app. When the ad rendered, the device's advertising ID and IP address were sent to the company's servers. If the device was a chosen target, it received malicious code that exploited vulnerabilities and installed the spyware; other devices got nothing, which helped keep the operation hidden.
According to BleepingComputer, which reviewed the report's details, Al Jazeera provided evidence of attacks on at least 45 devices between 2024 and 2025, and the ad operation placed 3.77 billion bids and won 442 million auctions between March and June 2026. Citizen Lab stresses that an ad impression is not the same as an infection: in most cases, the proven risk is profiling.
Where the ads showed up
Researchers found Discover-Tech ads on government networks in more than 20 countries, including Brazil, Mexico, Italy and Sweden, as well as on NATO, United Nations and European Union networks. In the US, the report lists impressions on networks of large tech and defense companies. The ads ran inside popular apps and websites, from language and weather apps to major news sites. The investigation is ongoing and was released alongside a probe by ad-security firm Confiant.
After being alerted, Google and IAB Europe removed Discover-Tech from their approved vendor lists, and Google and Beeswax cut the company's access to their ad systems. Candiru was already on the US Commerce Department's Entity List.
For everyday users, the takeaway is that ad tracking is also an attack surface. Keeping your phone and browser updated and limiting ad tracking in your privacy settings reduces exposure; for journalists, activists and public officials, the report calls for investigations on the affected networks.
