No click. No download. No suspicious link. Just an ad loading on a page, sometimes out of sight in the background.
On 15 October 2026, the University of Toronto's Citizen Lab confirmed that Candiru spyware reached devices at Al Jazeera through ordinary targeted online ads. It is the first public technical proof that mercenary spyware has infected real devices through the advertising system. Citizen Lab named the technique AdFection.
What happened
Al Jazeera's own IT team caught it first. In 2024 they noticed unusual patterns on devices used by some journalists, and in 2025 they handed network logs to Citizen Lab for a full investigation (Al Jazeera).
Those logs showed the same sequence on every infected device: a Discover-Tech ad server, then a Candiru server that screens the device, then a command-and-control server that runs the spyware (The Hacker News).
Al Jazeera also pulled a Windows program file off a compromised machine. Its code matched techniques from a Candiru tool Citizen Lab dissected in 2021, which is the basis for attributing the attacks to Candiru with high confidence.
Two limits worth stating plainly:
- Citizen Lab recovered the spyware, but not the exploit that broke into the browser or app. That first step is reconstructed from how the attack was set up.
- Citizen Lab has not said which government commissioned the attacks.
This isn't Al Jazeera's first time as a target. In 2020, dozens of its journalists' iPhones were hacked with NSO Group's Pegasus, in a separate operation.
How the attack worked
The trick is that the ad itself was clean. Each Discover-Tech ad carried a small script that, when the ad rendered, sent the device's advertising ID and IP address to a Discover-Tech server Citizen Lab calls the NOAS server. That server decided who was a target (Citizen Lab).
- The ad loads. A Discover-Tech ad renders in a website or app. Nobody has to click it.
- The ad phones home. Its script sends the advertising ID and IP address to the NOAS server.
- The server picks targets. Most devices get an empty response. Selected targets get code that leads to Candiru's servers.
- Candiru screens the device. A Candiru validator server checks the device before infection. The browser or app exploit used here was never recovered.
- The spyware runs. The implant talks to a command-and-control server. The Windows implant from this step was recovered.
Because most devices that rendered the ad got an empty response, the ad networks only ever saw a clean ad.
The scale
Al Jazeera is the confirmed victim, but the ad operation behind it was industrial. Most figures come from bidding records Discover-Tech left exposed on one of its own sites, so they undercount its total activity.
| Measure | Figure | Period |
|---|---|---|
| Ad bids placed | 3.77 billion | Mar to Jun 2026 |
| Ad auctions won | 442 million | Mar to Jun 2026 |
| Websites showing ads with the callback code | 120,768 | Mar to Jun 2026 |
| Mobile apps (Android and iOS) showing them | 75,373 | Mar to Jun 2026 |
| Ads served per day | about 10 million | Confiant estimate |
| Users sent to the operation's domains | hundreds of thousands to millions | Citizen Lab estimate |
Sources: BleepingComputer, The Hacker News.
The ads also turned up inside the networks of NATO, the United Nations, EU bodies, government offices in about two dozen countries, chipmakers and news organizations.
An ad showing up on a network is not proof of infection. It shows reach. Confiant found the few ads it could tie directly to Candiru were low-volume and mostly hit home and mobile connections, not those sensitive networks. The point is that the pipe was already connected to them.
Who's behind it
Discover-Tech is an Israeli company, registered in 2020, that presents itself as a normal digital ad firm. Citizen Lab calls it a bridge between mercenary spyware companies and the advertising ecosystem (BleepingComputer). Its platform, Controlium, let customers profile, de-anonymize and fingerprint devices, and target specific ones with malicious code.
The uncomfortable part: Google and IAB Europe both listed Discover-Tech as an approved ad vendor from 2020 until this month (The Hacker News). Citizen Lab calls it a troubling lack of due diligence within the digital advertising industry (Citizen Lab).
Candiru sells surveillance tools, officially only to governments. The US put it on a trade blacklist in 2021 over spyware used against officials, journalists and activists. In 2025 its assets moved to a new company, reported to be Integrity Labs, that the sanctions do not cover. Its past tools were delivered through Windows and Chrome zero-days.
Citizen Lab also ties Discover-Tech to other spyware and surveillance vendors, including Bindecy and Intelos (Citizen Lab). Discover-Tech and Candiru's owners did not respond to requests for comment.
How the industry responded
| Company | Action |
|---|---|
| Removed Discover-Tech from its vendor list and cut off ad exchange access | |
| IAB Europe | Suspended it after an audit found policy violations |
| Beeswax (Comcast) | Removed it |
| Vungle (Liftoff) | Paused its access pending review |
| Eskimi | Blocked its accounts |
Some platforms acted. Not all of them did, and Discover-Tech's website was still online when the report landed.
Why this matters for every business
Ads are attack surface now, and most security programs don't treat them that way.
Awareness training doesn't help. There is nothing to click, nothing to spot, and no suspicious sender. Standard awareness campaigns offer little protection when the victim takes no action at all (Computing).
The ad isn't the weapon, so filters miss it. Because the ad itself carried no attack code, the networks delivering it had nothing harmful to detect. The server decided who got the payload. Everyone else got an empty response.
Every ad is also a data leak. Even when nobody is targeted, the ad still sends data back to the operator: page cookies and the device's public IPv6 address (Citizen Lab). That's reconnaissance at scale, for free.
Mobile apps are the blind spot. About 77% of Discover-Tech's bids were for ads inside mobile apps, not browsers. Ads ran in mainstream apps including Viber, Truecaller, Yahoo Mail, Duolingo and weather apps. Browser ad blockers don't cover in-app ads.
“Certified” didn't mean safe. A vendor with years of spyware-industry ties sat on Google's and IAB Europe's approved lists from 2020 to 2026. Citizen Lab found no good evidence it earned money from legitimate advertising.
Citizen Lab's own conclusion is blunt: there is currently no consistently safe way to expose users and networks to targeted ads.
What to do now
Start with Citizen Lab's main recommendation: block online advertising at the network gateway and on work-issued devices. CISA and the NSA have both recommended ad blocking against malvertising before (Computing). Then close the gaps around it.
- Block ads at the gateway. Use DNS filtering or your secure web gateway to drop ad and tracking domains for every device on the corporate network, including guest and BYOD segments.
- Cover phones, not just laptops. Most of this campaign ran inside mobile apps, where browser extensions can't reach. Push DNS-level ad filtering to managed phones through your MDM.
- Take away the targeting key. The operator picked victims by advertising ID and IP address. On managed devices, turn off app tracking on iOS and delete the advertising ID on Android.
- Hand out hardened browsers. Give staff browsers with built-in anti-tracking protections as the default.
- Protect high-risk people harder. Executives, legal, finance, comms and anyone with sensitive access deserve stronger controls than the baseline. On iPhone, Lockdown Mode exists for exactly this threat class; on Android, turn on Advanced Protection.
- Patch browsers and operating systems fast. The ad only opens the door; a browser or app exploit does the break-in. Candiru's earlier chains used Windows and Chrome zero-days, so update cadence matters.
- Hunt for the indicators. Block the known infrastructure and search your logs for the attack's signature: a device hitting a Discover-Tech ad server, then a Candiru validator, then a command-and-control server.
Published indicators
Domains are defanged so they cannot be clicked by accident.
| Type | Indicator | Role |
|---|---|---|
| Domain | mtrtb[.]com | Discover-Tech ad server |
| Domain | keyadapter[.]com | Candiru validator |
| Domain | sharethere[.]net | Candiru validator |
| Domain | fearevolve[.]com | Candiru command and control |
| Domain | jobmarcher[.]com | Candiru command and control |
| SHA-256 | 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 | Recovered Windows spyware sample |
Sources: Citizen Lab, The Hacker News. Citizen Lab's report and Confiant's report carry the full indicator lists, including every Discover-Tech NOAS and tracking domain.
The bottom line
For years, “don't click suspicious links” was the advice. AdFection makes it irrelevant. A certified ad vendor, buying through the world's biggest ad exchanges, could put a spyware selector on almost 200,000 apps and websites, and the victims never had to do anything.
If your work devices show ads, they're attack surface. Block them at the gateway, cover the phones, and treat ad traffic like any other untrusted input.
Cynorida can help. We map where ad and tracking traffic reaches your network, lock it down across laptops and mobile, and hunt for the indicators above.
The poster
A one-page poster of the incident and the fixes, for teams to print or share. Its full text is below the image.
An ad is all it took
No click. No download. No warning.
The incident. Citizen Lab confirmed that Candiru spyware reached devices at Al Jazeera through targeted online ads. The ad only had to load. No click needed. At least 45 devices were targeted in 2024 and 2025. The ad network behind it ran ads on about 200,000 sites and apps, including on government and institutional networks.
The attack.
- AdFection: zero-click delivery through targeted ads.
- Candiru spyware, now rebranded Integrity Labs.
- About 10 million ads a day, across about 200,000 sites and apps.
Fix.
- Block at the gateway. Filter ad and tracker domains with DNS or proxy rules across the whole network.
- Lock down work devices. Enforce ad blocking on company laptops and phones through device management.
- Patch browsers fast. Keep browsers and mobile operating systems updated. The ad still needs an exploit to land.
- Protect high-risk staff. Turn on Lockdown Mode (iOS) or Advanced Protection (Android) for journalists, executives and admins.
Stay alert. Block the ads.
Sources
- Citizen Lab: Exposing AdFection (full report), 15 Oct 2026
- The Hacker News: Citizen Lab traces zero-click Candiru spyware infections at Al Jazeera to targeted ads
- BleepingComputer: Targeted ads installed Candiru spyware in zero-click attacks
- Computing: Zero-click spyware shows scale of adtech's security problem
- Al Jazeera: How Israeli firm's zero-click malware attack poses global security risk