Citizen Lab says at least 45 Al Jazeera devices were targeted in 2024 and 2025 through a zero-click spyware route linked to Discover-Tech ads and Candiru. In this kind of attack, ad code can run when an ad appears; the person does not have to click it. The lab’s report calls the operation AdFection and describes the evidence behind its attribution.
How an ad could deliver spyware without a click
The route begins when an ad is rendered—the moment it loads on a screen or in an app. Citizen Lab says the ad code could identify an eligible target and retrieve additional JavaScript, which could then load a browser exploit. The targeting step meant the server could send code to selected people while returning no code to others.
That sequence makes this different from a malicious ad that relies on someone clicking a link or downloading a file. A targeted person might not notice anything unusual. Bill Marczak, a senior researcher at Citizen Lab, told WIRED that a person could be hacked without seeing an ad at all.
What links the Al Jazeera attacks to Candiru
Citizen Lab’s account connects several technical traces. Logs from affected devices showed contact with Discover-Tech infrastructure, followed by a Candiru validator server and Candiru command-and-control infrastructure. A recovered Windows DLL contained hardcoded command-and-control servers that matched the lab’s Candiru fingerprint. The researchers also identified code behaviors—including COM hijacking for persistence and repeating XOR obfuscation—that matched an earlier Candiru sample. Citizen Lab describes these findings and its high-confidence attribution.
The sequence of contacts and the malware sample are the basis for the lab’s attribution; the reported campaign was not simply inferred from the presence of ads. Citizen Lab calls AdFection a zero-click attack because displaying a targeted ad could start the delivery chain without user interaction.
What the reach figures count
Citizen Lab analyzed nearly four billion publicly exposed bidding records. Within that analysis, MyDSP bid on 3,770,286,576 impressions and won 441,954,291, or 11.7% of its bids. At least 718,748,885 bids—about 19%—apparently involved ads with a script tag pointing to a NOAS server.
For March through June 2026, the lab counted ads with attacker script tags appearing in 75,373 Android and iOS apps and 120,768 websites. Those are counts of app and website placements. Separately, an endpoint associated with one Infinite FIFO infrastructure counted 3,637,213 eligible users from January through June 2026. That figure describes users eligible for targeting, not the number of devices Citizen Lab reported as targeted in the Al Jazeera cases.
The counts describe different parts of the advertising operation. Citizen Lab says Discover-Tech’s ads were not necessarily all weaponized; its report identifies at least 45 Al Jazeera devices targeted in the 2024–2025 campaign.
Platform actions and a practical mitigation
Google blocked Discover-Tech from its ad platforms and set up Safe Browsing warnings for websites linked to the group, according to Google’s statement reported by WIRED. Citizen Lab says Google terminated the company’s access to its ad-exchange platforms in early October 2026.
On October 8, 2026, IAB Europe removed Discover-Tech from its Global Vendor List, according to Citizen Lab. WIRED described the action as a suspension and reported that an IAB Europe spokesperson said further confirmation could justify definitive expulsion. Beeswax said it removed Discover-Tech from its platform; Citizen Lab also reported that Eskimi blocked related accounts, users and domains, while Vungle/Liftoff paused access pending review.
Citizen Lab recommends blocking ads on devices and at organizational gateways as a mitigation against this delivery route.
