Spyware was delivered through ordinary online ads, infecting devices without the victim clicking anything, according to a new Citizen Lab report. The University of Toronto researchers say an Israeli ad-tech company, Discover-Tech, used targeted ads to plant spyware made by Israeli vendor Candiru, and that at least 45 Al Jazeera devices were targeted in 2024 and 2025.
Citizen Lab calls the technique "AdFection" and says it is the first public technical confirmation of mercenary spyware reaching real devices through the advertising system.
How did the ad attack work?
According to Citizen Lab and ad-security firm Confiant, as reported by BleepingComputer and The Hacker News:
- Discover-Tech bought ad space through mainstream ad exchanges, like any advertiser.
- When the ad loaded, hidden code sent the device's advertising ID and IP address to a Discover-Tech server.
- That server checked whether the device was a target.
- Only targets got attack code. Everyone else got a normal ad.
- Infected devices then connected to a Candiru screening server and a command-and-control server.
No click was needed. Some ads loaded out of view in the background.
How big was the operation?
| Metric (March to June 2026) | Figure |
|---|---|
| Ad bids placed | ~3.77 billion |
| Auctions won | ~442 million |
| Apps carrying the code | ~75,000 |
| Websites carrying the code | ~120,000 |
| Ads per day (Confiant estimate) | ~10 million |
These are not infection counts. Attack code went only to selected targets. Confiant said the ads it tied to Candiru were low volume and mostly reached home and mobile connections. Ads also appeared on networks used by NATO, the UN, EU bodies and others, which does not mean those networks were infected.
Who are Discover-Tech and Candiru?
- Discover-Tech is an Israeli company registered in 2020 that presents itself as a standard ad firm. Citizen Lab describes it as "a bridge between mercenary spyware companies and the advertising ecosystem."
- Candiru sells spyware officially to governments only. The US put it on a trade blacklist in 2021. Its assets were later bought by a US investment firm, The Hacker News reports.
What did Al Jazeera say?
Al Jazeera Media Network said it "condemns the spyware attacks targeting a number of its staff," called targeting journalists an "assault on press freedom," and urged accountability. Its in-house team first noticed unusual activity in 2024 and worked with Citizen Lab to verify it.
What have the ad platforms done?
- Google cut off Discover-Tech's ad exchange access, saying it systematically violated policies.
- IAB Europe suspended it after an audit.
- Beeswax (Comcast) removed it.
- Vungle paused access; Eskimi blocked its accounts.
Discover-Tech and Candiru's owners did not respond to Reuters.
Should you worry, and how can you protect yourself?
For most people, the risk is very low: this was a targeted, expensive operation. But it shows that ads can be an attack route. Sensible steps:
- Update your phone, browser and apps promptly.
- Use an ad blocker and limit ad tracking in your phone's privacy settings.
- If you're a journalist, activist or official, turn on Lockdown Mode (iPhone) or Advanced Protection (Android).
Researchers have published indicators of compromise so security teams can check their networks.
