Citizen Lab describes AdFection, a targeted-advertising chain that could deliver mercenary spyware without a click. The attacks targeted at least 45 devices at Al Jazeera during 2024–2025; that number counts targets, not confirmed infections. The report attributes the spyware to Candiru and links its delivery to ads run through Discover-Tech. Citizen Lab’s technical report calls this the first public technical confirmation of mercenary spyware delivered through targeted ads.
How the ad chain selected targets
A rendered ad could request JavaScript from Discover-Tech’s infrastructure. A server then checked whether the viewer was eligible for further targeting. Citizen Lab says most viewers received no JavaScript, while the ad could still collect browser data, cookies and a device’s public IPv6 address.
Discover-Tech’s Controlium system supported selection using mobile advertising IDs, platform cookie IDs and IP addresses. For selected targets, the reported chain continued from Discover-Tech infrastructure to a Candiru validator server, then through further profiling and infection to a Candiru command-and-control server. “Zero-click” describes the absence of a user click in that delivery path; it does not mean every person who saw an ad was infected.
What the target count means
Citizen Lab reports that at least 45 Al Jazeera devices were targeted in 2024–2025 and that devices at the organization were infected. It does not say that all 45 or more targeted devices were successfully infected. The distinction matters: an ad impression, a selected target and a successful infection are separate stages of the chain.
The findings describe a selective route, not a mass infection of everyone who encountered an ad. Most viewers were not selected to receive JavaScript, although their browser and device data could still be collected during ad rendering.
What the ad records reveal about reach
Citizen Lab analyzed nearly four billion exposed bidding records from March through June 2026. In that dataset, MyDSP bid on 3,770,286,576 impressions and won 441,954,291, or 11.7% of its bids. Discover-Tech ads appeared in more than 70,000 mobile apps and 120,000 websites during the same period.
At least 718,748,885 bids—about 19%—contained an ad script tag pointing to a NOAS server; those ads appeared in 161 countries. These figures measure bidding activity and ad placement, not spyware infections. Their scale helps explain how an advertising system could provide broad reach while the exploit path remained selective. Citizen Lab’s report details the dataset and its scope.
How ad platforms restricted Discover-Tech
The companies took different actions against different parts of Discover-Tech’s access. In early October 2026, Google and IAB Europe removed Discover-Tech from vendor registries; Google also ended its access to the ad exchange. IAB Europe’s vendor-list entry ended on October 8, 2026.
Beeswax removed Discover-Tech from Buyer Cloud. Vungle (Liftoff) paused access while reviewing it. Eskimi blocked Discover-Tech accounts, users and domains after detecting evasive tags. Those steps ranged from removal and termination to a review pause and blocking. Citizen Lab’s account describes the separate actions.
Steps that can reduce exposure
Citizen Lab recommends using a trusted ad-blocking extension and network-level ad blocking, keeping devices updated, resetting mobile advertising IDs and disabling ad tracking. These measures reduce exposure; they are not a guarantee against spyware.
The report also includes Discover-Tech- and Controlium-related domains and NOAS endpoints. Because the delivery chain used third-party advertising systems, those indicators are best treated as one part of a broader defense, alongside ad blocking and timely updates.
