Devices at Al Jazeera were infected with Candiru spyware after targeted advertisements loaded, without anyone needing to click them. Citizen Lab’s October 15 investigation calls the delivery method AdFection: an advertising purchase became a route from an ordinary page or app to a spyware operator.
The documented attacks happened in 2024 and 2025. The new finding is how researchers connected the advertising company Discover-Tech to those infections. Their report identifies at least 45 Al Jazeera devices as targeted; it does not establish 45 successful infections. For everyone else, the practical lesson is that avoiding suspicious links leaves a different exposure untouched: code that arrives with an ad.
The ad did not need to look dangerous
Discover-Tech participated in the auctions that decide which advertisement appears in a website or app. Winning an auction let it deliver more than a picture. The ad also requested JavaScript from a Discover-Tech server, passing information that could help identify the viewer.
The revealing detail is what happened to an ordinary visitor: the server usually returned no JavaScript at all. A selected target could receive additional code. That selective response meant an advertisement could look uneventful during a check while behaving differently on the intended person’s device. Citizen Lab describes the server using IP addresses and advertising identifiers to decide who received code.
In the researcher’s examples, the ads appeared among familiar news pages and an Android Sudoku game. Those examples demonstrate delivery, not that the displayed pages or every person who saw the ads was compromised. A legitimate publisher can carry a third party’s ad without operating the attack infrastructure itself.
Al Jazeera’s network logs supplied the missing sequence
Al Jazeera gave Citizen Lab network records from the attack period. On infected devices, the researchers traced a progression: contact with Discover-Tech infrastructure, then a Candiru validation server, and eventually spyware command servers. The validation stage checked the device before the chain continued toward exploitation.
The report’s timeline puts the initial ad at zero seconds, the validator connection roughly one to two seconds later, and contact with an exploit server around five to ten seconds into the sequence. The running spyware established its command channel within roughly one to three minutes. These are approximate timings in the documented chain, not a universal stopwatch for every malicious ad.
There was also an artifact from a compromised computer: Al Jazeera isolated a Windows DLL containing two command-server addresses that matched the investigation’s infrastructure fingerprint. Citizen Lab compared its persistence and string-obfuscation behavior with earlier Candiru research and assessed the link with high confidence. That combination of logs and a recovered implant gives the case more weight than an advertising impression alone.
The report does not provide a universal version list or one patch that closes every AdFection route. Its mobile-app advertising measurements also should not be read as confirmation that the documented Windows implant infected every platform. Gridinsoft’s earlier Candiru coverage concerned a separate Chrome exploitation case.
Four billion records measure reach, not four billion victims
A separate part of the investigation examined nearly four billion bidding records exposed by Discover-Tech. For March through June 2026, the researchers found its advertisements had appeared across more than 70,000 mobile apps and 120,000 websites. Those figures describe an advertising operation’s reach, not a count of infected people.
Citizen Lab also observed large-scale contacts with Candiru infrastructure that it assessed as likely reconnaissance and tracking. A device being profiled, a device being selected for an attack, and spyware successfully running on a device are three different findings. Collapsing them would turn evidence of a broad delivery system into an unsupported mass-infection claim.
The case extends a familiar advertising privacy problem. Auction identifiers can help follow a person between contexts; here, the same targeting machinery could also decide where to deliver exploit code. The separate Xandr and Grindr enforcement case shows the sensitivity of data entering ad auctions, while AdFection concerns actual spyware delivery.
Disconnecting one buyer does not remove the whole attack surface
Citizen Lab says Google and IAB Europe removed Discover-Tech from their vendor registries in early October. Google terminated its access to Google’s ad exchanges; Beeswax removed it from its buying platform; Liftoff paused access while reviewing; and Eskimi blocked its accounts and domains. These are specific responses to the investigation, not evidence that all ad-delivered spyware has stopped.
The researchers recommend blocking advertisements and tracking on devices and, where possible, at the network gateway, alongside limiting mobile advertising identifiers. A browser extension can reduce browser exposure, but should not be assumed to cover ads inside every app. People at elevated risk because of their work should seek specialist help rather than treating a clean browsing history or the absence of clicks as reassurance.
AdFection changes the question from “Did I click it?” to “What code was allowed to reach this device, and what happened next?” In the Al Jazeera case, that second question is what connected an ordinary-looking advertisement to a recovered spyware implant.
References
- Marczak, B. et al. Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware. Citizen Lab, University of Toronto, Report 195, October 15, 2026.
