Citizen Lab: Mercenaries Used Ad Networks for Zero-Click Attacks on Al Jazeera Staff
Researchers reveal how mercenary spyware vendors used ad networks to profile and infect devices without user interaction.
Key points
- Citizen Lab linked Candiru spyware to Discover-Tech’s ad delivery infrastructure.
- Al Jazeera staff had at least 45 devices targeted in zero-click attacks.
- Discover-Tech’s platform bid on nearly 3.77 billion ad impressions in four months.
Citizen Lab researchers have linked the Israeli spyware vendor Candiru to an advertising infrastructure operated by Discover-Tech, enabling zero-click infections of target devices. The university-based security group published findings showing how surveillance companies used online ad networks to profile users and deliver exploits without requiring any interaction from the victims.
The investigation connects Discover-Tech to Candiru, which the US government placed on its Entity List in 2021 and which now operates under the name Integrity Labs. Citizen Lab also identified links to other surveillance firms, including Bindecy and Intelos, suggesting that the Discover-Tech infrastructure served multiple customers rather than just one spyware vendor.
Scale of Ad Infrastructure
The researchers analyzed almost four billion advertising bid records spanning March to June 2026. During this period, Discover-Tech’s MyDSP platform bid on 3,770,286,576 ad impressions and won approximately 442 million of them. According to the report, about 76.7 percent of these bids were for mobile app impressions, while 23.3 percent targeted web browsers.
Reuters, citing Citizen Lab and advertising security firm Confiant, reported that this activity reached more than 120,000 websites and 75,000 apps. This widespread presence potentially exposed hundreds of millions of people to the tracking infrastructure, although exposure does not equate to infection. The system allowed Discover-Tech to profile users at scale and select specific devices for more intrusive operations.
Al Jazeera Targeted
In 2024 and 2025, the international news network Al Jazeera was targeted in a series of zero-click attacks linked with high confidence to Candiru spyware. Citizen Lab determined that at least 45 devices within the broadcaster were targeted during these campaigns. This finding expands on earlier reporting by Threat Times, which noted in October 2026 that researchers had identified this new mercenary spyware delivery method called AdFection.
Citizen Lab reached this conclusion by examining network logs supplied by Al Jazeera. The researchers linked the activity to Candiru spyware delivered through Discover-Tech advertisements, providing technical evidence of a real operation rather than a theoretical attack scenario. The report notes that the database showed only three advertisers with nine total combinations between advertiser and domain names during the analysis period.
What should you do?
Security teams should monitor for unauthorized ad-related network traffic and review logs for connections to known spyware infrastructure. Organizations should assess their ad-tech dependencies and consider restricting ad loading in sensitive environments. Users should remain vigilant for unusual device behavior, as zero-click exploits require no interaction to install malware.
What to do and how to stay safe: Candiru
- Monitor network logs for connections to known spyware infrastructure or unusual ad-tech domains.
- Review ad-loading policies in sensitive corporate environments to reduce exposure to malicious creatives.
- Check device integrity regularly for signs of unauthorized software or anomalous resource usage.
- Stay updated on vendor advisories and apply patches once the vendor provides an update for any identified vulnerabilities.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a mercenary spyware delivery method identified by Citizen Lab that uses online ad networks to deliver exploits without requiring user clicks.
Which spyware vendor is linked to this activity?
The investigation links the activity to Candiru, an Israeli spyware vendor also known as Integrity Labs, which was placed on the US Entity List in 2021.
How many devices were affected at Al Jazeera?
At least 45 devices within Al Jazeera were targeted in zero-click attacks linked to Candiru spyware delivered via Discover-Tech ads between 2024 and 2025.
