Citizen Lab says targeted ads delivered Candiru spyware to Al Jazeera devices without a click
Researchers tie Israeli ad firm Discover-Tech to a campaign they call AdFection. Ars Technica and Tech Times differ on which devices were infected.
Online ads were used to install mercenary spyware on devices at Al Jazeera without users clicking anything, according to a report from the University of Toronto's Citizen Lab. Ars Technica and Tech Times both reported the findings.
Citizen Lab named the campaign AdFection. It said the campaign infected 45 devices at the broadcaster in 2024 and 2025. The two outlets describe those devices differently. Ars Technica reported that the attacks worked on iOS and Android devices. Tech Times reported that the infected machines were at least 45 Windows computers, and said a Windows DLL file was recovered from one of them.
Both outlets reported that the ads came from Discover-Tech, an Israeli company that presents itself as a legitimate ad firm. Citizen Lab said it works as a link between the ad industry and spyware vendors. Citizen Lab said that acting as this bridge appears to be "Discover-Tech's primary purpose." The researchers attributed the malware to Candiru, which Ars Technica said now operates as "Integrity Labs." According to Ars Technica, Citizen Lab said this is likely the first confirmed case of zero-click mercenary spyware delivered through targeted ads.
The finding matters because the ads ran through mainstream channels. Ars Technica reported that Discover-Tech served ads through Google, Yandex and Beeswax. It said Google and the industry group IAB Europe had listed the firm as a "certified" or "verified" vendor and have since removed it. Tech Times reported that ordinary users got blank responses and only chosen targets received the exploit, which it said kept the payload hidden from ad security scanners.
The reach figures are close but not the same. Ars Technica reported that Citizen Lab obtained more than 4 billion bidding records, and that the ads appeared in over 70,000 apps and more than 120,000 websites between March and June 2026. Tech Times put the bids in that period at 3,770,286,576, across 75,373 apps and 120,768 websites.
The two outlets also list different sensitive networks. Ars Technica said Discover-Tech ad impressions appeared on networks at NATO, the United Nations and European lawmaking bodies. Tech Times, citing a parallel investigation by the ad security firm Confiant, named the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Tech Times said Citizen Lab cautioned that ad traffic on those networks does not necessarily mean devices there were infected.
“This investigation should… serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat.”Citizen Lab researchers, as quoted by Ars Technica
Several questions are still open. Tech Times reported that Citizen Lab cannot yet say which government client of Candiru was behind the attacks. Ars Technica said the report does not describe which vulnerabilities were exploited. It also said Discover-Tech and Candiru did not answer its messages.
