An entity linked to the Israeli company Discovere-Tech used targeted digital advertisements to deliver Candiru spyware to devices belonging to Al Jazeera Media Network, in a “zero-click” attack that required the victim only to view the advertisement on their device. Citizen Lab researchers called this technique AdFection, considering it the first public technical confirmation of mercenary spyware being delivered through targeted advertisements.
The investigation was based on evidence provided by Al Jazeera, network logs, and a DLL file recovered from a compromised Windows system. The evidence indicates that at least 45 devices were targeted between 2024 and 2025, with a communications sequence that began with Discovere-Tech’s infrastructure, then passed through Candiru’s verification servers, and ended at the spyware’s command-and-control servers.
How did the infection chain work?
The attacking entity purchased advertising space through well-known advertising networks and exchanges, embedding JavaScript code in the advertisements that connected, when displayed, to a server Discovere-Tech called NOAS, or the getAd server. The server used indicators such as the IP address and advertising identifiers to determine whether the device matched the target’s specifications.
If the device passed the verification process, additional code was sent to it; other devices simply displayed the advertisement without receiving the malicious payload. This selectivity reduces noise and helps conceal the operation within ordinary advertising traffic.
The operation’s scope does not equal the number of infections
Between March and June 2026, the operation submitted 3.77 billion ad bids and won 442 million auctions, according to Citizen Lab estimates. Advertisements containing the attacking code tags appeared in 75,373 applications on Android and iOS and on 120,768 websites. These figures do not mean that all of these applications and websites, or their users, were infected.
Researchers estimated that hundreds of thousands to millions of users were directed to domains associated with Discovere-Tech advertisements. After receiving reports from Citizen Lab, Google, IAB Europe, Beeswax, Eskimi, and Vungle took action, including removing violating accounts and blocking access to specific domains.
Why does this method matter?
The incident shows that the digital advertising chain can become a channel for delivering advanced spyware, even without direct user interaction. Targeting specific devices also makes the campaign harder to detect than broad malicious campaigns, while purchasing advertisements through major networks expands its potential reach.
Candiru is associated with spyware that the company officially sells to governments, including DevilsTongue for Windows, which can steal files, credentials, and messages. The company’s tools have previously been linked to the exploitation of zero-day vulnerabilities in Windows and Chrome to target journalists, activists, and politicians.
A similar method was previously documented under the name Aladdin in late 2025, when advertisements were used to infect targets with Predator spyware without a click, but that investigation relied on files and marketing documents leaked from Intellexa. AdFection, by contrast, was based on actual attacks and forensic evidence linking them to Discovere-Tech, which Citizen Lab described as a link between mercenary spyware companies and the advertising ecosystem.