Discover-Tech Ads Enable Zero-Click Candiru Spyware on 45 Al Jazeera Devices
Citizen Lab researchers reveal how mercenary spyware infected Al Jazeera devices simply by displaying targeted advertisements, requiring no user interaction.
Key points
- Citizen Lab documented the first public proof of zero-click spyware delivered through ads.
- At least 45 Al Jazeera devices were targeted between 2024 and 2025.
- The campaign used Discover-Tech to link ad targeting with Candiru spyware.
The AdFection campaign allowed attackers to install spyware on devices merely by displaying an advertisement. This method required no clicks, downloads, or user warnings. Citizen Lab researchers identified this as the first publicly documented case of zero-click mercenary spyware distributed via targeted ads. The operation enabled the delivery of spyware linked to Candiru by exploiting the automated nature of modern ad delivery networks.
How it unfolded
- October 15, 2026: Citizen Lab published its investigation into the AdFection method.
- 2024-2025: At least 45 Al Jazeera devices were targeted.
- Post-infection: Systems contacted Discover-Tech infrastructure, then Candiru validation and command servers.
Who is affected
The primary confirmed victims were devices belonging to the Al Jazeera news network. According to the Citizen Lab report, at least 45 devices were targeted during 2024 and 2025. The campaign utilized Discover-Tech, an Israeli company that facilitates ad targeting. While millions of devices were directed toward Candiru-linked servers for potential checks, seeing an ad does not confirm infection. Only the Al Jazeera devices have been verified as infected so far.
The fix
No patch or specific remediation update has been confirmed by the vendors or researchers involved. Organizations should treat this as an ongoing threat vector. Because the infection relies on standard ad loading processes, standard user caution like avoiding clicks is insufficient. Managed service providers must assume that any device exposed to these specific ad networks could be at risk until further technical details or updates are released by the affected vendors.
What made it possible
This technique exploits the complex ecosystem of programmatic advertising. Modern ads often contain code for tracking and measurement, which runs automatically when the ad loads. Attackers leverage real-time bidding data, such as device IDs and IP addresses, to identify specific targets. By injecting malicious code into the ad delivery chain, they can serve payloads only to selected devices. This stage serves as the initial compromise vector, bypassing user interaction entirely. Teams should monitor for unauthorized outbound connections from ad-related processes, as these often signal the start of a zero-click intrusion.
What to do and how to stay safe: AdFection
- Review network logs for connections to known Discover-Tech or Candiru infrastructure.
- Audit ad inventory to ensure only trusted ad networks are allowed on managed devices.
- Monitor for unexpected JavaScript execution or outbound calls immediately after ad loads.
- Isolate devices that show signs of communication with spyware command-and-control servers.
Step-by-step guide: Offline Backups: Real Protection Against Ransomware and Data Loss
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the spyware infect devices without user interaction?
The spyware was delivered through targeted ads that loaded code automatically when displayed, requiring no clicks.
Which organization was targeted by the AdFection campaign?
Al Jazeera devices were targeted, with at least 45 confirmed infections between 2024 and 2025.
Is there a patch available for this vulnerability?
No fix has been confirmed yet by the vendors or researchers involved in the investigation.
