Citizen Lab describes AdFection as a way to deliver mercenary spyware through targeted online ads without a victim clicking a link. Its report links Discover-Tech’s advertising infrastructure to the delivery of Candiru spyware on devices at Al Jazeera. One distinction matters throughout the findings: an ad appearing on a device did not mean that every viewer was selected or infected.
TL;DR: Citizen Lab calls AdFection the first public technical confirmation of zero-click mercenary spyware delivered via targeted ads. It says at least 45 Al Jazeera devices were targeted in 2024 and 2025 in attacks linked with high confidence to Candiru spyware delivered through Discover-Tech ads. Analysis of about four billion bidding records showed ads across nearly 200,000 websites and apps, not 200,000 infections. CPJ says the report did not identify a government or client that ordered the attacks.
What Is AdFection?
AdFection is the name Citizen Lab gave to the delivery technique described in its October 15, 2026 report. The researchers call it the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. In the cases they examined, an online ad was part of the route used to deliver spyware, so the selected target did not have to click a message or open a downloaded file.
The report connects the technique to devices at Al Jazeera and spyware attributed to Candiru, also known as Integrity Labs. It identifies Discover-Tech as the company whose ads were involved. These are specific research findings about a documented campaign, not evidence that every online ad or every advertising platform can infect a device. The Citizen Lab report provides the technical account and its evidence.
How Can an Ad Become a Zero-Click Delivery Channel?
Citizen Lab describes a sequence that begins with a normal advertising auction. Discover-Tech wins a bid, and an ad is delivered to a website or app open on a user’s device. When the site or app renders the ad, it requests JavaScript from a Discover-Tech server embedded in the ad. If the person is selected for targeting, that delivery path can continue toward the malicious content. The user does not have to tap the ad or approve a download.
The report also makes clear that ad delivery and infection are not the same event. In most cases, the person who saw an ad was not the selected target, and the server returned no JavaScript for execution. Citizen Lab says the ad could still collect information from the browser, including cookies set on the page and the device’s public IPv6 address. That is a privacy concern, but it does not establish that the device was infected.
This distinction corrects an easy but inaccurate shorthand: simply seeing any online ad was not enough to infect every viewer. The attacks depended on targeting a selected device and on the subsequent steps described in the report. The zero-click property means that no action by that selected victim was required for the spyware delivery chain to proceed.
What Did Researchers Find on Al Jazeera Devices?
Citizen Lab says Al Jazeera was targeted in a series of zero-click attacks in 2024 and 2025. It linked the attacks with high confidence to Candiru spyware delivered through Discover-Tech ads. The researchers state that at least 45 devices within Al Jazeera were targeted. CPJ reports the same minimum number of targeted devices. The public figure refers to targets, not a confirmed count of 45 infections. CPJ’s account notes the limits of attribution.
The researchers used network logs supplied by Al Jazeera to describe the sequence. Infected devices first contacted Discover-Tech infrastructure, consistent with an ad impression. The devices then connected to a Candiru validator server, which checked a device before further profiling and infection. In the final stage described by Citizen Lab, an infected device communicated with a Candiru command-and-control server. The researchers used that temporal pattern, along with infrastructure and implant analysis, to connect the ad activity with the spyware.
The distinction between “targeted” and “infected” is important. The report documents infections in Al Jazeera’s network, but the public figure of at least 45 refers to devices targeted in the attacks. It should not be restated as a precise count of confirmed infections.
What Do the Advertising-Scale Numbers Mean?
Citizen Lab analyzed about four billion Discover-Tech bidding records. Across a four-month period, the company’s ads appeared on nearly 200,000 unique websites and Android and iOS apps in dozens of countries. This describes where ads were shown in the observed data. It is not a count of infected devices, successful attacks, or selected targets.
The report also says Discover-Tech ads covertly directed millions of devices to contact Candiru servers. The researchers assess that this activity was likely for large-scale tracking and reconnaissance. That is their interpretation of the observed traffic; it does not mean all of those devices were infected. The report’s advertising counts and its Al Jazeera attack evidence answer different questions and should not be merged into one number.
What Was Discover-Tech’s Controlium Platform?
Citizen Lab describes Controlium as a Discover-Tech platform that let customers target individual users with so-called “controlled ads.” According to the report, the platform supported selecting a target based on a mobile advertising identifier for iOS or Android, a browser identifier, and/or an IP address. The researchers say its functions could support de-anonymizing, fingerprinting, profiling, and delivering malicious content to selected users.
The research team reviewed publicly accessible front-end code from the platform to reconstruct parts of its interface. It says most customer and operations data remained behind authorization. The existence and described functions of the interface help explain how the targeting could be configured; they do not by themselves identify the customers behind a particular operation.
Citizen Lab describes Discover-Tech as an Israeli company that presented itself as an advertising business and says it acted as a facilitator for multiple mercenary spyware partners. The report links its advertising infrastructure to Candiru in the Al Jazeera case. That finding concerns the role of the company and the delivery system; it does not identify who commissioned the attacks.
What Happened After the Findings Were Disclosed?
Citizen Lab says it disclosed its findings to advertising vendors and industry organizations. It reports that Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took action to disconnect Discover-Tech’s access to the digital advertising ecosystem. This records actions reported by the researchers after disclosure; it does not establish that every provider removed every possible route for abuse.
The researchers’ recommendations go beyond removing one company. They call for real-time detection of malicious ads, recurring checks of business partners, audits of vendor registries, and stronger security and transparency across the advertising supply chain. CyberScoop provides additional coverage of the findings and their implications for ad companies and regulators.
What Does the Report Not Establish?
The report links a delivery technique and advertising infrastructure to spyware infections at Al Jazeera. It does not name a government or a specific client as the party that ordered the attacks. CPJ explicitly notes this limit. It would therefore be inaccurate to assign responsibility to a particular state or customer based only on the public findings described here.
Nor do the figures for websites and apps establish that those publishers, their users, or their organizations were infected. Most ad viewers were not selected for targeting, according to Citizen Lab. The researchers also say an ad could collect browser data even when no JavaScript was returned, so privacy exposure and spyware infection are separate outcomes. Keeping those categories distinct is necessary to describe both the scale of the advertising activity and the evidence for the Al Jazeera attacks accurately.
What Defenses Does Citizen Lab Recommend?
For organizations, Citizen Lab recommends blocking ads and tracking both on devices and at the network gateway. It also recommends opting out of ad targeting on company-issued devices, using browsers with stronger anti-tracking features, and monitoring advertising-related traffic for suspicious requests. The report says there is currently no consistently safe way for high-risk users and networks to be exposed to targeted ads, so reducing that exposure is a practical defensive measure.
For individual users, the report suggests trusted ad-blocking, privacy-respecting browsers, resetting or disabling mobile advertising identifiers where available, and seeking expert help when a person’s risk is elevated. These steps reduce exposure; the report does not present them as a guarantee against spyware. Its broader recommendations ask advertising vendors to detect malicious ads, vet partners, share threat data, and audit the supply chain more rigorously.
Frequently Asked Questions
Does AdFection require the victim to click an ad?
No. The attacks described by Citizen Lab were zero-click, so the selected target did not need to click or open a file. But an ad impression alone did not mean that every viewer was infected. In most cases, the viewer was not selected and the server returned no JavaScript.
Were all 45 Al Jazeera devices confirmed infected?
The published figure is at least 45 devices targeted in 2024 and 2025. Citizen Lab documents infections in Al Jazeera’s network, but the figure should not be described as a confirmed infection count for all 45 devices.
Does the nearly 200,000 figure mean that many devices were infected?
No. It refers to unique websites and Android or iOS apps where Discover-Tech ads appeared during the analyzed period. It is not a count of infected devices or successful spyware attacks.
Who ordered the attacks on Al Jazeera?
The public report does not name a government or a specific client as responsible for ordering them. CPJ explicitly notes that limit. The findings link the delivery to Discover-Tech ads and Candiru spyware, not to a named sponsor.
Summary
- Citizen Lab describes AdFection as a zero-click spyware delivery technique using targeted ads.
- At least 45 Al Jazeera devices were targeted in 2024 and 2025; that figure is not a confirmed infection count.
- About four billion bidding records showed ads across nearly 200,000 websites and apps, not nearly 200,000 infections.
- Citizen Lab links the delivery path to Discover-Tech ads and Candiru spyware, but the report does not identify the client or government that ordered the attacks.
- Recommended measures include blocking ads at device and network levels, limiting ad tracking, and improving vendor screening and audits.
Sources: Citizen Lab’s technical report, Committee to Protect Journalists, and CyberScoop’s coverage.