The key facts

  • Citizen Lab named the technique 'AdFection' — the first public technical confirmation of commercial spyware delivery via targeted ads without a click
  • At least 45 Al Jazeera devices were targeted in 2024–2025; the link to Candiru was established with high confidence
  • Discover-Tech ads appeared on more than 120,000 websites and 70,000 apps, including BBC, NYT, Duolingo; Google, IAB Europe and other platforms severed ties

Spyware via ads without a click

The Citizen Lab at the University of Toronto published an investigation showing how online advertising infrastructure was used to track devices and deliver spyware, including attacks on journalists. The technique was named 'AdFection'; according to the researchers, this is the first public technical confirmation of the delivery of 'mercenary' spyware via targeted advertising without any interaction from the victim. The investigation focuses on the Israeli advertising company Discover-Tech and the Israeli spyware maker Candiru, which changed its name to Integrity Labs. In November 2021, the US Department of Commerce added Candiru to the trade blacklist, stating that the company supplied spyware to foreign governments for attacks on journalists, activists and officials. Earlier that year, Microsoft together with Citizen Lab identified more than 100 victims of spyware linked to the company.

Attacks on Al Jazeera

Citizen Lab identified at least 45 Al Jazeera devices targeted in attacks in 2024 and 2025, and linked the operation with high confidence to Candiru spyware delivered through Discover-Tech ads. The researchers confirmed infections, but the figure of 45 refers to targeted devices, not the confirmed number of successful compromises. Using network logs provided by Al Jazeera, it was possible to reconstruct the course of the attacks: a device loaded a website or app with Discover-Tech advertising, which could appear on screen or load in the background without a click. Code in the ad contacted Discover-Tech servers, transmitting advertising identifiers and the public IP address. The server assessed whether the device matched the attacker's criteria: most users received no additional code, while selected targets received code that connected the device to Candiru infrastructure. The link to Candiru is also supported by technical fingerprints of the infrastructure (hundreds of domains and IP addresses) and a malicious file from an infected Windows device containing server addresses matching Candiru infrastructure. Citizen Lab previously described Candiru spyware as capable of stealing passwords and messages, taking screenshots, and activating the microphone and webcam. Al Jazeera condemned the attacks on its staff, calling the targeting of journalists 'an attack on press freedom' and demanding that those responsible be held accountable.

Scale of reach

The researchers examined nearly 4 billion ad bidding records from March to June 2026 and found Discover-Tech ads on more than 120,000 websites and over 70,000 mobile apps worldwide. The ads directed millions of devices to servers linked to Candiru, potentially enabling large-scale tracking and reconnaissance; this does not mean millions of devices were infected, since profiling, target selection and spyware installation are separate stages. The ads reached devices in state-managed networks in 24 countries, including Italy, Denmark, Norway, Australia, Russia, Mexico and Israel, as well as the American territory of American Samoa. It appeared on popular websites and apps, including BBC, The New York Times, Duolingo and AccuWeather. Separately, the ad security firm Confiant found signs of the ads in networks associated with the US Department of Defense, the IAEA and the International Criminal Court. These findings demonstrate the operation's reach but do not prove that users of these networks were selected for attacks or were infected.

Why it was possible and the industry response

Citizen Lab describes the online advertising ecosystem as 'ripe for abuse': real-time bidding, advertising identifiers, third-party scripts and targeting allow precise targeting and code execution inside websites and apps. Selective delivery made detection difficult: the platform Eskimi told Citizen Lab that the ads loaded different code depending on the viewer's device, IP address and location, helping to evade automated checks. From 2020 to 2026, Discover-Tech appeared on the lists of 'certified' or 'approved' vendors of Google and the industry association IAB Europe and used major platforms including Google, Yandex, Vungle, Eskimi and Comcast-owned Beeswax. After the disclosure, Google and IAB Europe removed Discover-Tech from their vendor registries; Google also terminated the company's access to its ad exchanges, Beeswax removed it from its platform, Vungle suspended access pending review, and Eskimi blocked the company's accounts and domains.

Implications for digital security

Citizen Lab also identified another actor, named Dark Cartographer, which used Discover-Tech infrastructure and vulnerabilities in mobile carrier systems to link advertising identifiers to phone numbers, potentially enabling mass de-anonymization of users; details will be presented in a separate report. The researchers called for stronger regulatory oversight of advertising companies and recommended that organizations block targeted advertising at network gateways. Citizen Lab director Ron Deibert told the Canadian broadcaster CBC: 'The moment (the ad) is displayed, the device can be hacked, so there is practically no defense against this other than giving up your smartphone or the internet.' He called the findings a 'worst-nightmare scenario' combining targeted advertising and mercenary spyware — 'two poorly regulated and heavily abused industries' — and added: 'This is a recipe for disaster. This is global espionage that we have uncovered on a massive scale.'