AdFection Spyware Infects Journalists via Zero-Click Ad Delivery
Research confirms that online ads delivered zero-click mercenary spyware to Al Jazeera journalists, enabling comprehensive device surveillance without user interaction.
Key points
- Citizen Lab identified AdFection as the first zero-click mercenary spyware delivered through digital advertisements.
- The malware was built by Candiru, now Integrity Labs, and facilitated by Discover-Tech.
- Infected devices experienced theft of credentials, keystrokes, audio, and video without any clicks.
Al Jazeera journalists were infected with sophisticated surveillance malware in 2024 through online advertisements that required no user interaction to execute. Canadian cybersecurity firm Citizen Lab confirmed these incidents as the first known cases of zero-click mercenary spyware delivered via ad-tech infrastructure, a campaign researchers have named AdFection.
The infection occurred simply when the advertisements were served to the journalists’ devices, not when they were clicked or even viewed with interest. According to TechRadar, the malware acted as an infostealer capable of harvesting sensitive data including files, documents, cookies, bookmarks, and saved credentials. It also captured keystrokes, took screenshots, and recorded audio and video using the device’s microphone and camera.
Technical Context and Attribution
Citizen Lab and Al Jazeera released findings linking the operation to two Israeli firms: Candiru and Discover-Tech. Candiru, which has rebranded as Integrity Labs following a reported acquisition, is a mercenary spyware company that sells surveillance tools to government customers. Researchers stated that Candiru built both the infostealer and the delivery mechanism used in this attack.
The cost of the infostealer tool was reported to be several million dollars. While the specific buyers of the tool and the identities of those directing the surveillance remain unknown, the researchers identified the facilitators. Discover-Tech was also named as a facilitator in the operation, tied to the ad-tech infrastructure that enabled the delivery.
Impact and History
The victims included Al Jazeera journalists who noticed their devices acting strangely in 2024 before seeking assistance. The malware exfiltrated email messages and instant messages shared across a wide range of platforms. This incident highlights the severe risks associated with ad-tech supply chains, where commercial infrastructure can be leveraged for targeted espionage.
Candiru, now Integrity Labs, was blacklisted by the US Department of Commerce in early November 2021. The blacklisting cited evidence that the company supplied spyware to foreign governments used to target government officials, journalists, and activists. Despite this regulatory action, the firm’s tools were utilized in this recent campaign against media professionals.
What should you do?
Security professionals should monitor for unusual device behavior, such as unexpected resource usage or camera activation, which may indicate infostealer presence. Organizations should audit ad-blocking configurations and ensure that legacy or unpatched software is removed to reduce attack surfaces. Reviewing network logs for anomalous data exfiltration patterns can help detect silent surveillance campaigns.
What to do and how to stay safe: AdFection
- Monitor endpoints for unauthorized access to microphones, cameras, or keystroke logging indicators.
- Audit digital advertising filters and ensure they are actively blocking known malicious ad networks.
- Review network traffic logs for unusual outbound connections that may signal data exfiltration.
- Verify that all devices are running the latest security patches once vendors provide updates.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection spyware?
AdFection is a zero-click mercenary spyware campaign that infects devices through served online advertisements without requiring user interaction.
Who built the AdFection malware?
The malware and its delivery mechanism were built by Candiru, now known as Integrity Labs, with facilitation by Discover-Tech.
Did the victims have to click the ads?
No, the infection occurred when the ads were served to the device, not when they were clicked or viewed.
