Candiru spyware delivered to Al Jazeera devices via malicious targeted ads in zero-click 'AdFection' attacks
Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of mercenary spyware delivered through targeted ads. The activity is linked to the Israeli firm Discovere-Tech (also written Discover-Tech), described as a bridge between mercenary spyware vendors and the advertising ecosystem. Al Jazeera supplied evidence of attacks against at least 45 devices between 2024 and 2025. After Citizen Lab's reports, Google, IAB Europe, Beeswax, Eskimi and Vungle removed offending accounts and blocked access to domains.
Technical Details
- Discover-Tech's Controlium platform let customers target specific devices with malicious code, or profile, deanonymize and fingerprint devices.
- The company bought ad placements through mainstream ad networks and exchanges and embedded JavaScript in the ads. When rendered, the ads contacted its NOAS server (also called the "getAd server").
- The server used parameters such as IP address and ad identifiers to decide whether a device was eligible. Selected targets received additional code and all other devices received nothing, which kept the operation stealthy.
- Network logs showed a sequence from Discover-Tech infrastructure to Candiru validation servers and then to spyware command-and-control servers.
- Researchers recovered a DLL from a compromised Windows system and attributed it to Candiru with high confidence, based on infrastructure and code overlaps with previously captured samples.
- Candiru also developed the Windows malware DevilsTongue, which can steal files, credentials and messages. Past reports tie its tools to Windows and Chrome zero-day exploits used against journalists, activists and politicians.
- Scale of the ad operation between March and June 2026: 3.77 billion bids and 442 million auctions won. Ads assessed to carry attacker script tags appeared across 75,373 Android/iOS apps and 120,768 websites. These figures are not infection counts, but Citizen Lab estimates hundreds of thousands to millions of users were directed to the attacker domains.
- A similar technique, Aladdin, was documented by Amnesty International in late 2025 delivering Predator (Intellexa) via ads. It was identified from leaked Intellexa documents, whereas AdFection was observed in real attacks.
Remediation
The article gives no defender-side guidance beyond the takedowns. The ad networks named above removed the offending accounts and blocked the domains after receiving Citizen Lab's reports.
Linha do tempo
-
Candiru spyware delivered to Al Jazeera devices via malicious targeted ads in zero-click 'AdFection' attacks
ler a análise desta fonte ocultar
Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of mercenary spyware delivered through targeted ads. The activity is linked to the Israeli firm Discovere-Tech (also written Discover-Tech), described as a bridge between mercenary spyware vendors and the advertising ecosystem. Al Jazeera supplied evidence of attacks against at least 45 devices between 2024 and 2025. After Citizen Lab's reports, Google, IAB Europe, Beeswax, Eskimi and Vungle removed offending accounts and blocked access to domains.
Technical Details
- Discover-Tech's Controlium platform let customers target specific devices with malicious code, or profile, deanonymize and fingerprint devices.
- The company bought ad placements through mainstream ad networks and exchanges and embedded JavaScript in the ads. When rendered, the ads contacted its NOAS server (also called the "getAd server").
- The server used parameters such as IP address and ad identifiers to decide whether a device was eligible. Selected targets received additional code and all other devices received nothing, which kept the operation stealthy.
- Network logs showed a sequence from Discover-Tech infrastructure to Candiru validation servers and then to spyware command-and-control servers.
- Researchers recovered a DLL from a compromised Windows system and attributed it to Candiru with high confidence, based on infrastructure and code overlaps with previously captured samples.
- Candiru also developed the Windows malware DevilsTongue, which can steal files, credentials and messages. Past reports tie its tools to Windows and Chrome zero-day exploits used against journalists, activists and politicians.
- Scale of the ad operation between March and June 2026: 3.77 billion bids and 442 million auctions won. Ads assessed to carry attacker script tags appeared across 75,373 Android/iOS apps and 120,768 websites. These figures are not infection counts, but Citizen Lab estimates hundreds of thousands to millions of users were directed to the attacker domains.
- A similar technique, Aladdin, was documented by Amnesty International in late 2025 delivering Predator (Intellexa) via ads. It was identified from leaked Intellexa documents, whereas AdFection was observed in real attacks.
Remediation
The article gives no defender-side guidance beyond the takedowns. The ad networks named above removed the offending accounts and blocked the domains after receiving Citizen Lab's reports.