Citizen Lab Details AdFection Zero-Click Spyware Delivered Through Targeted Online Ads

Citizen Lab published a report on 15 October documenting the first publicly confirmed cases of zero-click mercenary spyware delivered through targeted online advertisements. The technique, which the researchers named AdFection, was used to infect at least 45 devices at the Al Jazeera media network with spyware attributed to the Israeli company Candiru, now known as Integrity Labs.

The ads were purchased by Discover-Tech, an Israel-registered firm that presented itself as a legitimate advertising company. Citizen Lab found that Discover-Tech operated a platform called Controlium that allowed spyware partners to profile and de-anonymise users at scale and then serve malicious code inside ordinary-looking ads. Once the ad rendered, the device could be infected without the user clicking anything. The researchers recovered evidence of infections at Al Jazeera in 2024 and 2025.

Discover-Tech had been listed as an approved advertising vendor by Google and by IAB Europe since 2020. Analysis of nearly four billion bid records showed Discover-Tech ads appearing on more than 120,000 websites and 70,000 mobile apps between March and June 2026, including major news outlets and apps such as Duolingo and Grindr. The firm bid 3.7 billion times in that period and won 442 million placements.

Citizen Lab senior researcher Bill Marczak said the system turns trusted websites and apps into a delivery platform for spyware. Targets would see nothing unusual; in some cases they might not even notice an ad. The report states that Controlium was used by multiple spyware vendors, including Candiru and Bindecy, to reach government officials, journalists, activists and others.

Google and IAB Europe removed Discover-Tech from their approved lists after being shown the findings. The researchers note that the advertising ecosystem’s real-time bidding system, designed for commercial targeting, was weaponised to select specific devices and deliver exploits. Millions of devices were directed toward profiling servers before a smaller number received the actual spyware payload.

The Al Jazeera infections involved Windows computers. Citizen Lab said it has high confidence that the spyware was Candiru’s and that the delivery vector was Discover-Tech ads. No government client has been named. The report is the first technical demonstration of zero-click mercenary spyware moving through the open advertising market rather than through email, messaging apps or watering-hole sites.

The scale of the bidding activity shows how an ad-tech intermediary can sit between commercial ad exchanges and state-linked spyware operators. Once a device is fingerprinted and selected, the next ad impression can carry the exploit. The removal of Discover-Tech from major vendor lists closes one channel, but the underlying real-time bidding architecture remains open to similar abuse by other actors.