Staff at the international news network Al Jazeera have been targeted in a sophisticated cyber espionage campaign, with at least 45 devices infected by the notorious Candiru spyware. According to a comprehensive report published by the Canadian internet watchdog group Citizen Lab, the intrusions were executed through zero-click attacks delivered via targeted digital advertisements, revealing a alarming new vector utilized by mercenary spyware vendors to bypass traditional security perimeters.
The operation, which researchers have designated "AdFection," weaponized the complex and fast-paced ecosystem of online advertising. In this campaign, ads purchased by an Israeli company identified as Discover-Tech were deployed to de-anonymize, fingerprint, and ultimately infect users, while simultaneously enabling threat actors to track millions of connected devices across the globe.
To understand how the AdFection operation succeeded, security analysts point to the mechanics of the modern web advertising ecosystem. Every day, companies participate in billions of automated Real-Time Bidding (RTB) auctions hosted on ad exchanges. These auctions determine which advertiser gets the opportunity to serve an ad to a specific user visiting a website or opening an application.
As part of this routine process, ad exchanges collect extensive device and user data designed to facilitate precise targeting and tracking. While standard advertisements contain benign code that runs locally in a user’s application or browser to track impressions and clicks, the Citizen Lab report highlights how this infrastructure can be subverted. Threat actors have found that malicious code can be seamlessly injected into ad units. Because of the vast array of unique identifiers embedded within the programmatic advertising ecosystem, these malicious payloads can be weaponized to target specific, high-value individuals with advanced surveillance software.
Investigators concluded that Discover-Tech, which initially presented itself as a legitimate advertising enterprise, functioned as a front for a large-scale cyberespionage campaign. The company effectively served as a bridge connecting conventional ad vendors with mercenary spyware developers. At the heart of its operations was a proprietary platform known as Controlium. This framework enabled the mass de-anonymization of millions of internet users, sophisticated device fingerprinting, and automated zero-click hacking that initiated the moment an ad was rendered on a victim’s device.
While evidence gathered by Citizen Lab indicates that Discover-Tech may collaborate with multiple surveillance actors, researchers definitively confirmed its role in profiling and infecting targets on behalf of Candiru. Candiru is an Israel-based private spyware vendor known for developing invasive surveillance tools utilized by state-sponsored clients and intelligence agencies against journalists, dissidents, and political opponents.
The technical mechanism behind the AdFection vector relies on automation. Many of the advertisements deployed by Discover-Tech contained a specialized script designed to automatically establish a connection back to the company’s command-and-control infrastructure. Once connected, the script submitted the specific advertising identifier of the targeted user. This triggered the execution of customized JavaScript code, which was dynamically served based on a precise combination of the user’s IP address and device identifiers.
The campaign’s impact on Al Jazeera was both focused and substantial. Between 2024 and 2025, researchers tracked at least 45 distinct devices within the prominent news organization that were successfully targeted in AdFection attacks, resulting in the successful deployment of Candiru’s spyware suite.
The scale of Discover-Tech’s broader operations extended far beyond a single media outlet. Citizen Lab reported identifying a single Discover-Tech server that inadvertently exposed four billion ad bid records. An analysis of these records revealed that advertisements tied to Discover-Tech had been distributed across nearly 200,000 unique websites and applications running on both Android and iOS operating systems worldwide.
In addition to detailing the Controlium platform, the AdFection attack chain, and the underlying ad deployment mechanisms, Citizen Lab’s investigation examined Discover-Tech’s broader relationships with other actors in the digital surveillance marketplace. Among these connections was an entity tracked as Dark Cartographer. According to researchers, this group has been actively building extensive databases linking users’ mobile advertising identifiers directly to their personal phone numbers by exploiting vulnerabilities across various telecommunications carriers, effectively executing mass de-anonymization on a global scale.
The fallout from Citizen Lab’s disclosures prompted swift defensive actions across the technology and advertising sectors. In early October, industry leaders including Google and IAB Europe moved aggressively to remove Discover-Tech from their official ad vendor registries. Google took direct action by blocking Discover-Tech’s access to its primary ad exchange platforms, while similar restrictive measures were enforced by Beeswax and Eskimi.
Despite these industry sanctions, cybersecurity experts warn that the underlying threat remains potent. Given the persistent danger posed by Discover-Tech’s AdFection vectors and the clear evidence of wide-scale, indiscriminate targeting, Citizen Lab concluded that the most feasible protection for high-risk organizations is to block targeted advertisements at the network gateway. Researchers noted that this defensive recommendation should remain in place until the broader advertising and technology industry can reliably demonstrate an ability to proactively block all AdFection-style attack vectors.
