Citizen Lab Exposes 'AdFection': Zero-Click Candiru Spyware Delivered Through Ordinary Ads

Citizen Lab Exposes "AdFection": Zero-Click Candiru Spyware Delivered Through Ordinary Ads

Citizen Lab, the University of Toronto's internet research lab, has published "Exposing AdFection," a report detailing the first public confirmation of a mercenary spyware operation delivered entirely through ordinary online advertisements — no malicious link, attachment, or click required. The report, authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert, and published October 15, 2026, traces zero-click infections at Al Jazeera Media Network back to spyware made by Israeli vendor Candiru (now rebranded as Integrity Labs), delivered through an ad-tech pipeline built by a firm Citizen Lab calls Discover-Tech.

Details

How the Attack Worked

AdFection required no action from the victim beyond having an ad render on their screen — sometimes without even being visually displayed. Because the ad itself carried no overtly malicious payload, the ad exchanges and networks that served it had nothing conventionally harmful to flag.

1. Ad impression — A targeted ad, purchased through mainstream ad-exchange placements by Discover-Tech, loads on the victim's device. A small embedded script calls back to a Discover-Tech server.
2. Device fingerprinting — That server checks parameters tied to the device, including its IP address and advertising identifiers, to determine whether it matches a selected target.
3. Selective delivery — Most visitors who load the ad receive nothing further. A matched target's browser is instead handed JavaScript that proceeds to a Candiru validator server, which performs an initial check of the device.
4. Profiling and infection — Following validation, the device is profiled further and ultimately infected, with traffic progressing to a Candiru command-and-control server.

Citizen Lab recovered a Windows DLL from a compromised Al Jazeera device and attributed it to Candiru with high confidence: the file shares its persistence technique and a distinctive 48-byte XOR encryption key with a Candiru sample the lab dissected back in 2021.

Scope Beyond Al Jazeera

The 45 confirmed Al Jazeera targets are a narrow slice of a much larger advertising footprint. Citizen Lab found that Discover-Tech's ads also appeared on networks used by NATO, the United Nations, European Union institutions, and the U.S. Department of Defense — the report does not claim those organizations' personnel were deliberately targeted, but their ad-serving infrastructure carried the same Discover-Tech inventory capable of profiling and selecting targets.

Even visitors who were not selected for infection were not entirely unaffected: the ad's callback script still read and transmitted the device's public IPv6 address and leaked tracking cookies back to Discover-Tech's infrastructure, regardless of whether a target match occurred — an ordinary-looking ad impression that nonetheless performed reconnaissance on every viewer. Citizen Lab also identified an IP address tied to Saudi Arabia's foreign ministry as a probable target, though the report does not attribute the operation to a specific government customer.

Response

Following Citizen Lab's disclosure, several ad-industry players acted to cut off the infrastructure: Google, IAB Europe, Beeswax, Eskimi, and Vungle removed Discover-Tech-linked accounts and blocked access to the attacker-controlled domains identified in the report. Al Jazeera Media Network said it "condemns the targeting of devices belonging to several of its employees with spyware" and pledged to continue protecting its staff and systems.

Impact Assessment

Recommendations

For Journalists, Activists, and High-Risk Individuals

Treat any device used for sensitive work as a potential target for mercenary spyware delivered through channels that require no interaction at all — traditional "don't click suspicious links" advice does not cover this attack class. Where available, enable device-level protections such as Apple's Lockdown Mode or equivalent hardened configurations, and consider periodic forensic review of devices with Citizen Lab, Amnesty International's Security Lab, or similar organizations if targeting is suspected.

For Enterprises, Government Agencies, and Network Operators

Citizen Lab's report specifically recommends mandatory ad-blocking on government-issued devices and networks, since conventional ad-network vetting did not catch this operation. Disable advertising identifiers on work phones and review whether browsers in use allow users to fully disable ad tracking — the AdFection pipeline relied on exactly the identifiers these settings expose.

For Ad-Tech and Publisher Platforms

Audit demand-side platform (DSP) and exchange relationships for intermediaries capable of targeted, server-side payload delivery rather than static creative — the absence of malicious code in the ad asset itself is precisely what let this operation evade conventional ad-quality scanning. Tighten vetting of advertising partners that request granular device/IP targeting capabilities beyond what standard campaign optimization requires.

Key Takeaways

1. Citizen Lab's "Exposing AdFection" report, published October 15, 2026, documents the first confirmed case of zero-click mercenary spyware delivered through ordinary online ads.
2. Candiru (rebranded Integrity Labs) spyware infected at least 45 devices at Al Jazeera Media Network in 2024–2025, attributed with high confidence via code and infrastructure overlap with a 2021 sample.
3. The delivery mechanism, built by Discover-Tech via its Controlium platform, required no malicious ad creative — targeting logic ran server-side, selecting victims by IP address and advertising identifiers after an ad simply rendered.
4. Discover-Tech's ad inventory reached NATO, UN, EU, and U.S. Department of Defense networks, and at least one other spyware vendor, Bindecy, used the same platform.
5. Non-targeted viewers were still profiled — their IPv6 addresses and tracking cookies were collected regardless of whether they matched a target.
6. Google, IAB Europe, Beeswax, Eskimi, and Vungle removed Discover-Tech-linked accounts and blocked identified attacker domains following disclosure.

Sources

• Citizen Lab: Exposing AdFection — How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
• BleepingComputer: Zero-click attacks used targeted ads to deliver Candiru spyware
• The Hacker News: Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads