Pull to refresh
Logo
Researchers confirm zero-click spyware delivered through targeted ads

Researchers confirm zero-click spyware delivered through targeted ads

New Capabilities

Citizen Lab finds Israeli ad firm Discover-Tech helped infect Al Jazeera devices with Candiru spyware

Yesterday: AdFection reports published

Overview

Updated 1 hour ago

Citizen Lab has documented the first confirmed case of zero-click spyware being delivered through targeted online ads. The technique, which researchers named AdFection, allowed an Israeli advertising firm to silently infect devices at Al Jazeera with Candiru spyware by showing users an ordinary-looking ad.

The attack runs through the global digital advertising system, which conducts billions of split-second auctions each day. Discover-Tech's ads reached more than 120,000 websites and 75,000 apps, and researchers estimate hundreds of millions of people were profiled in the process.

Why it matters

The global ad system touches billions of devices daily; turning it into a spyware channel means loading a webpage could infect any phone or computer.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

45
Al Jazeera devices infected
Windows devices compromised with Candiru spyware between 2024 and 2025.
120,000+
Websites showing Discover-Tech ads
Ad impressions reached sites across dozens of countries over a four-month period.
75,000+
Apps showing Discover-Tech ads
Apps carried the same ads alongside the website placements.
10M
Ads delivered per day
Confiant cofounder Jerome Dangu's estimate of Discover-Tech's daily ad volume.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

November 2021 October 2026

4 events Latest: Yesterday
Tap a bar to jump to that date
  1. AdFection reports published

    Latest Disclosure

    Citizen Lab and Confiant release first public confirmation of zero-click mercenary spyware delivered via targeted ads.

  2. Google and IAB Europe drop Discover-Tech

    Regulatory

    Google terminates Discover-Tech's ad access; IAB Europe suspends its certified vendor status after an audit.

  3. Al Jazeera infections begin

    Incident

    45 Windows devices at Al Jazeera infected with Candiru spyware delivered through Discover-Tech ads.

  4. US blacklists Candiru

    Regulatory

    Commerce Department adds Candiru to the Entity List for developing spyware targeting officials and journalists.

Scenarios

1

Discover-Tech faces legal action or shuts down

Possible Resolves by End of 2027

Discussed by: Reuters, WIRED, security researchers

Regulators, affected companies, or victims file lawsuits against Discover-Tech or named executives for facilitating spyware infections. This could also include criminal charges in countries where the affected networks are based. The company has already lost access to Google's ad systems and its IAB Europe certification, which may undermine its business model.

2

Ad-delivered spyware spreads to other vendors

Likely Resolves by End of 2027

Discussed by: Citizen Lab, Confiant, Ars Technica

Other mercenary spyware firms adopt the AdFection technique, using ad networks to profile and infect targets. Confiant noted that Candiru-linked ads were a tiny fraction of Discover-Tech's volume, suggesting the platform served multiple spyware clients. A second documented case would confirm the technique is becoming a standard delivery method.

3

Ad-tech industry tightens vendor vetting

Possible Resolves by Q2 2027

Discussed by: Google, IAB Europe statements

Google and IAB Europe introduce permanent certification or audit requirements that screen ad vendors for connections to surveillance and spyware activity. Both organizations have already taken preliminary action against Discover-Tech. Durable reforms would make it harder for similar firms to operate through certified ad networks.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

July 2021

Pegasus Project (2021)

A consortium of 17 media organizations revealed that NSO Group's Pegasus spyware had been used to hack phones of journalists, human rights lawyers, and heads of state in multiple countries. The investigation, based on a leaked list of 50,000 phone numbers, exposed the scale of commercial spyware abuse.

Then

Governments and the European Parliament opened inquiries; Apple filed a lawsuit against NSO Group.

Now

The US Commerce Department added NSO and Candiru to its Entity List in November 2021, restricting their access to US technology.

Why this matters now

The Pegasus Project established the pattern of mercenary spyware being used against journalists and activists. AdFection shows the same firms finding a new delivery channel through the commercial ad ecosystem.

June 2023

Operation Triangulation (2023)

Kaspersky researchers discovered an iOS exploit chain that infected iPhones with zero user interaction, delivered through malicious iMessage attachments. The spyware, called TriangleDB, exfiltrated data and could record audio and track location.

Then

Apple issued patches for the four vulnerabilities; Kaspersky identified the spyware as targeting its own employees and other respondents.

Now

It demonstrated that zero-click exploits work in the wild against modern smartphones.

Why this matters now

Operation Triangulation proved zero-click infection was technically possible at scale. AdFection is the first confirmed case of the same technique being delivered through the online advertising pipeline.

Sources

(10)