Citizen Lab Links Discover-Tech Ads to Zero-Click Candiru Spyware Attacks
Research reveals an Israeli ad firm used targeted advertisements to fingerprint devices and deliver mercenary spyware to journalists without interaction.
Key points
- Citizen Lab confirms Discover-Tech ads delivered Candiru spyware to Al Jazeera devices via zero-click exploits.
- The Controlium platform enabled de-anonymization and tracking of millions of devices through real-time bidding auctions.
- At least 45 Al Jazeera devices were targeted in AdFection attacks between 2024 and 2025.
Citizen Lab reports that Israeli advertising company Discover-Tech served as a delivery channel for Candiru spyware, infecting devices at Al Jazeera through zero-click attacks. This finding expands on earlier Threat Times reporting regarding the AdFection campaign that compromised journalists via targeted advertisements.
The Canadian internet watchdog group states that ads purchased by Discover-Tech allowed threat actors to fingerprint, track, and infect selected targets. The operation leveraged the real-time bidding ecosystem to de-anonymize users and execute malicious code upon ad display.
The AdFection Campaign Mechanics
Citizen Lab describes Discover-Tech as a likely front for a large espionage campaign, bridging ad vendors and mercenary spyware providers. The company’s Controlium platform facilitates the de-anonymization of millions of users and enables zero-click hacking when an ad loads on a victim’s device.
According to Citizen Lab, many Discover-Tech ads contain scripts that automatically connect to its infrastructure. These scripts submit advertising IDs and execute JavaScript code based on IP addresses and other identifiers, allowing precise targeting of individuals within the advertising ecosystem.
Scope and Data Exposure
Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in AdFection attacks, resulting in Candiru spyware infections. Citizen Lab identified a Discover-Tech server that exposed four billion ad bid records, highlighting the massive scale of data collection involved in these operations.
The research indicates that Discover-Tech’s ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide. While the company appears to work with multiple mercenary partners, Citizen Lab has confirmed its specific use to profile users and infect them on behalf of Candiru.
What should you do?
Security professionals should monitor for unauthorized connections to advertising infrastructure and review logs for unusual JavaScript execution. Organizations should assess their exposure to real-time bidding platforms and consider restricting ad-serving capabilities on sensitive devices.
What to do and how to stay safe: Discover-Tech
- Audit network logs for connections to known advertising infrastructure or suspicious JavaScript execution patterns.
- Review device permissions and installed applications for unknown tracking scripts or ad-related components.
- Limit the use of public Wi-Fi networks on devices handling sensitive information to reduce exposure to targeted ads.
- Monitor for unusual battery drain or data usage, which may indicate background spyware activity.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the spyware infect the devices?
The spyware was delivered via zero-click attacks using targeted advertisements that executed malicious code upon display.
Which company provided the spyware?
Candiru, an Israel-based spyware vendor, provided the malware used in the AdFection campaign.
How many devices were affected at Al Jazeera?
At least 45 devices within Al Jazeera were targeted in attacks between 2024 and 2025.
