Citizen Lab says a mercenary spyware operation used ordinary online advertising to silently compromise at least 45 Windows devices at Al Jazeera, providing the first public technical confirmation of a zero-click spyware infection delivered through a targeted ad.
The University of Toronto research group published the findings on October 15 after analyzing network logs from attacks in 2024 and 2025. Its AdFection investigation connects the attack chain to Discover-Tech, an Israeli company that participated in major advertising exchanges, and to spyware attributed to Candiru, which now operates under the Integrity Labs name.
The significance goes beyond another malicious banner. The victim did not have to click, download a file or open a message. The ad system supplied the targeting and delivery path, and code returned by the attacker’s server ran when the ad rendered in a browser or app. An ad could also load in the background, leaving the user with no visible warning.
How the AdFection attack chain worked
Most digital ads are selected through real-time bidding, an automated auction that occurs in the brief interval before a page or app displays an ad. Advertisers and their intermediaries can receive signals about the device, network and user to decide whether to bid for that impression.
Citizen Lab found that Discover-Tech operated a platform called Controlium that adapted this machinery for surveillance. The process worked in five stages:
- Win an ad impression. Discover-Tech bought the opportunity to display an apparently ordinary ad on a website or inside an app.
- Collect identifiers. The rendered ad contacted Discover-Tech infrastructure and could transmit an advertising identifier, public IP address, cookies and device characteristics.
- Select the intended target. A server the researchers call NOAS decided whether the device matched a target. Most devices received an empty response, which helped keep the malicious code out of the ad creative inspected by exchanges.
- Validate and exploit the device. A selected device was redirected to infrastructure attributed to Candiru for further profiling and infection. Citizen Lab has not published the browser vulnerability or full exploit chain used against Al Jazeera.
- Connect to command-and-control. A successfully infected computer contacted a Candiru server that could direct the implant.
Al Jazeera’s network logs showed that sequence in time: a Discover-Tech ad impression, contact with a Candiru validator, and then communication with command-and-control infrastructure. Investigators also recovered a Windows DLL from a compromised computer. Its behavior resembled an earlier Candiru implant, including COM hijacking for persistence and a repeating XOR key used to obscure strings.
The recovered sample has the SHA-256 hash 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. Citizen Lab also associated historical validator activity with domains including keyadapter[.]com and sharethere[.]net, and command-and-control activity with fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com and plasticbells[.]com. Some of the server behavior was being retired by mid-2026, so those indicators are useful for historical hunting but should not be treated as a complete or current blocklist.
Four billion bids show the reach, not four billion infections
The researchers analyzed almost four billion exposed bidding records covering March through June 2026. Discover-Tech ads appeared across more than 70,000 mobile apps and more than 120,000 websites, and millions of devices were directed to infrastructure associated with Candiru for what Citizen Lab describes as profiling and reconnaissance.
Impressions were recorded on networks associated with NATO, United Nations bodies, European institutions, governments, militaries, critical infrastructure, media organizations and semiconductor companies. The ads also surfaced on mainstream sites and in apps ranging from weather and language-learning tools to calling and dating services.
Those figures do not show that every device, organization or network was targeted for infection. An ad impression confirms that Discover-Tech reached the device and could collect data; it does not by itself prove that exploit code was returned or spyware was installed. The 45 Al Jazeera devices are different because the organization supplied network evidence that linked the impression, validation and command-and-control stages.
This distinction matters because the advertising system is both the attack’s distribution channel and its camouflage. Nearly all impressions can behave like routine tracking while the server returns an exploit only to a chosen device. That makes malicious activity difficult for exchanges to reproduce and for endpoint teams to find after the fact.
Advertising companies have cut off Discover-Tech
Google worked with Citizen Lab and ad-security company Confiant on the investigation, then removed Discover-Tech from its vendor registry and terminated its access to Google’s ad exchanges in early October. Google also added Safe Browsing warnings for known actor-controlled domains.
IAB Europe suspended Discover-Tech from its global vendor list. Beeswax, owned by Comcast, removed the company from its buying platform; Vungle parent Liftoff paused access while reviewing the findings; and Eskimi blocked associated accounts and domains. Discover-Tech, Candiru, Bindecy and several other firms did not respond to Citizen Lab by its publication deadline. TechCrunch reported that the governments behind the documented attacks remain unknown.
Cutting off one company reduces immediate exposure, but the technique is not tied to a single exchange or vendor. The report argues that self-attested “approved” lists and fragmented supply chains let an intermediary operate at scale without meaningful recurring scrutiny.
What security teams should change now
For organizations with journalists, government staff, executives, researchers, lawyers or other high-risk personnel, ad traffic now belongs in the threat model. Citizen Lab’s recommendations translate into several practical controls:
- Block advertising and tracking at the network gateway. DNS filtering, secure web gateways and browser policy can reduce exposure on managed networks. Filtering must cover in-app traffic as well as browser pages.
- Deploy approved content blockers on endpoints. A gateway cannot protect a laptop or phone that is using home Wi-Fi or mobile data. Managed browser extensions and privacy-focused browser settings close part of that gap.
- Disable or reset mobile advertising identifiers. MDM policies can limit ad tracking on work devices. On personal devices, users can reset or delete the advertising ID and deny app-level tracking where the operating system allows it.
- Inspect ad-impression traffic. Security teams should preserve DNS, proxy and endpoint telemetry that can connect an ad request to a validator and later command-and-control activity. A single domain hit is weaker evidence than the full sequence.
- Hunt retrospectively. Search historical logs for the published domains and the recovered DLL hash, then examine the surrounding requests and the affected endpoint. Because infrastructure changes, absence of those indicators does not rule out related activity.
- Keep browsers, apps and operating systems patched. Ad delivery identifies and reaches the device, but an exploit still needs a software flaw or misconfiguration to achieve code execution.
Ad blocking is not a guarantee. Some apps use embedded advertising components, some traffic may evade DNS-based filters, and a determined operator can change infrastructure. It is still a meaningful reduction in attack surface, particularly when combined with tracking restrictions, rapid patching and network telemetry.
What individuals at elevated risk can do
People who may be selected because of their work or public profile should use a reputable content blocker in supported browsers, choose browsers with strong built-in anti-tracking, disable personalized advertising, review app tracking permissions and consider network-level ad blocking at home. The report’s defense guidance also recommends expert help for people who face a specific surveillance risk.
Those steps are more effective than trying to identify a suspicious-looking banner. In a zero-click campaign, the visible ad may be benign, may never appear on screen, and may deliver nothing malicious to anyone except the intended target.
AdFection turns a familiar privacy problem into a security boundary. Real-time bidding was designed to decide which message reaches a particular device. Citizen Lab’s evidence shows that the same precision can decide which device receives an exploit.
