Online ads delivered Candiru spyware in zero-click attacks on Al Jazeera devices

Mercenary spyware vendor Candiru infected target devices through malicious online advertisements that required no user interaction beyond simply rendering on a screen. Researchers at Citizen Lab documented the zero-click attack technique, dubbed AdFection, after examining evidence from Al Jazeera Media Network showing at least 45 devices were targeted between 2024 and 2025. Forensic analysis of a compromised Windows system recovered a DLL file that researchers linked with high confidence to Candiru. [2][3]

The campaign relied on Israeli advertising company Discover-Tech and its Controlium platform, which served as an intermediary between ad exchanges and spyware operators. Discover-Tech bought ad inventory across mainstream networks, embedding JavaScript that contacted its servers to evaluate IP addresses and advertising identifiers. If a rendered ad matched an intended target, additional malicious payloads deployed, while untargeted devices received nothing to preserve stealth. [1][2]

Between March and June 2026 alone, the advertising operation placed 3.77 billion bids and won 442 million auctions, serving scripts across 120,768 websites and 75,373 mobile apps. Citizen Lab estimated that hundreds of thousands to millions of users encountered the domains. In response to the findings, digital ad firms including Google, Beeswax, Eskimi, Vungle, and IAB Europe moved to remove offending accounts and block the malicious domains. [2]