Citizen Lab Confirms AdFection: Zero-Click Spyware Hits Al Jazeera via Discover-Tech Ads

Citizen Lab has confirmed the first public instance of zero-click mercenary spyware being delivered via targeted online advertisements, a technique the research group calls AdFection. This finding expands the known capabilities of commercial spyware operators by showing how they can bypass user interaction entirely through the digital advertising supply chain.

The attack targeted at least 45 devices belonging to Al Jazeera, deploying Candiru spyware, which is now operated under the rebranded name Integrity Labs. According to GBHackers, the malicious advertisements were purchased by Discover-Tech, an Israeli ad-tech firm that provided the infrastructure for targeting specific individuals through real-time bidding auctions.

Technical Mechanics and AdFection

Online advertisements are sold in real-time auctions that complete in under a second, allowing advertisers to use device identifiers, IP addresses, and location data to target specific users. Citizen Lab researchers found that many ads served by Discover-Tech contained script tags that communicated with a server labeled "NOAS."

The server responded with JavaScript only to eligible targets based on their IP address and ad identifiers, while sending a zero-byte response to all other users. This design prevented malicious code from being visible to ad vendors or general observers, effectively hiding the attack within standard ad traffic.

Platform Vulnerabilities and Scope

Discover-Tech operates a platform called Controlium, which allows customers to select victims by mobile ad ID, cookie ID, or IP address to push controlled ads. Citizen Lab identified significant weaknesses in this platform, noting that it misused Auth0, which could allow attackers to forge authentication tokens.

An unauthenticated endpoint for downloading CSV files exposed login logs, enabling researchers to retrieve 128 days of records covering 120 usernames. Analysis of nearly four billion bidding records showed Discover-Tech ads appeared on almost 200,000 websites and apps over four months, pushing millions of devices to contact Candiru servers.

Al Jazeera Devices and Spyware Traits

Network logs from the Al Jazeera incidents showed a consistent sequence: the device contacted Discover-Tech infrastructure to mark an ad impression, then connected to a Candiru validator server, and finally reached a command-and-control server. Researchers recovered a Windows DLL from a compromised device that hardcoded C&C servers fearevolve[.]com and jobmarcher[.]com.

The malware persists through a COM hijack and obfuscates strings using a 48-byte repeating XOR key, traits that match Candiru’s 2021 infection chain. Discover-Tech appeared on certified vendor lists from Google and IAB Europe from 2020 to 2026, highlighting the difficulty of detecting malicious actors within approved advertising networks.

What should you do?

Security professionals should monitor network traffic for unexpected connections to known spyware command-and-control domains, such as fearevolve[.]com and jobmarcher[.]com. Organizations should review ad-tech vendor lists and verify the security posture of platforms handling sensitive targeting data.

What to do and how to stay safe: Candiru

• Monitor network logs for connections to known Candiru or Integrity Labs command-and-control infrastructure, particularly after ad impressions.
• Audit ad-tech vendors and partners for security vulnerabilities, especially those handling real-time bidding and user identification data.
• Review authentication configurations for third-party platforms to ensure tokens cannot be forged or misused, as seen with the Auth0 issue.
• Inspect browser and application logs for suspicious script executions or zero-byte responses that may indicate targeted ad-based reconnaissance.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AdFection and how does it work?

AdFection is a zero-click spyware delivery technique where malicious ads target specific users via real-time auctions, sending JavaScript only to eligible devices based on IP and ad identifiers.

Which spyware was used in the Al Jazeera attacks?

The attacks used Candiru spyware, now rebranded as Integrity Labs, which was delivered through advertisements purchased by the Israeli firm Discover-Tech.

Were there security flaws in the ad-tech platform used?

Yes, Citizen Lab found that Discover-Tech’s Controlium platform misused Auth0 and had an unauthenticated endpoint that exposed login logs for 120 usernames.