Just seeing an online ad on your screen could be enough to get your device hacked. That is the finding at the center of a landmark investigation published by the University of Toronto’s Citizen Lab this week, which describes a technique called AdFection — the first publicly confirmed case of mercenary spyware delivered through targeted advertising with no click, no download, and no visible sign that anything happened.
At least 45 devices belonging to the international news network Al Jazeera were targeted in 2024 and 2025, according to the report. Researchers link the attacks with high confidence to Candiru, the Israeli mercenary spyware vendor now operating under the Integrity Labs brand, whose malware was delivered through ordinary-looking banner ads purchased by an Israeli advertising company called Discover-Tech.
What Is AdFection?
AdFection is the name Citizen Lab gave to the technique: zero-click mercenary spyware delivered through targeted online ads. It works by exploiting the same real-time bidding infrastructure that serves normal banner ads across websites and mobile apps.
When Discover-Tech won an automated auction to place an ad on a website or inside an app on a target’s device, the ad carried embedded JavaScript. The moment the ad rendered — visibly or in the background — that code could check whether the viewer matched a target list. If the device matched, the ad pulled down additional JavaScript and then browser exploits or spyware payloads. For everyone else, the ad simply displayed normally. Bill Marczak, a senior researcher at Citizen Lab, told WIRED that a person could be hacked without even seeing an ad at all.
The report, the lab’s 195th, was published alongside a parallel investigation by Confiant, a New York-based ad security firm.
Who Is Discover-Tech and What Is Controlium?
Discover-Tech Ltd. is a Tel Aviv-based advertising technology firm. Citizen Lab says it presents itself as a legitimate advertising company but in fact operates as a purpose-built bridge between the online advertising industry and the commercial spyware market.
The bridge is a platform called Controlium. According to the investigation, Controlium lets Discover-Tech’s mercenary partners de-anonymize, fingerprint, and automatically infect devices the moment an advertisement renders. Operators could select individuals for profiling or infection using mobile advertising IDs, browser cookie identifiers, and IP addresses — targeting routed through the same auction system that picks which ad a person sees.
Citizen Lab also found that Discover-Tech operated an ordinary ad-buying platform called MyDSP alongside Controlium, and that Discover-Tech was on lists of certified and approved vendors maintained by Google and the advertising industry association IAB Europe from 2020 until 2026. Its ads were served through major ad networks including Google, Russia’s Yandex, and Comcast’s Beeswax. After the disclosure, Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi all cut the company’s access.
How the Al Jazeera Attacks Worked
Citizen Lab reached its conclusions by examining network logs supplied by Al Jazeera. Compromised devices first contacted Discover-Tech infrastructure, then a Candiru validation server, and finally Candiru command-and-control infrastructure. Researchers recovered a Windows DLL containing hardcoded command-and-control servers that matched Citizen Lab’s Candiru fingerprint, alongside code behaviors — including COM hijacking for persistence and repeating XOR obfuscation — matching an earlier Candiru sample.
That chain of evidence is the basis for the high-confidence attribution to Candiru. The researchers note that the campaign was not simply inferred from the presence of ads; it was reconstructed from technical traces on the devices themselves. Candiru spyware is capable of giving operators remote access to compromised systems, enabling data theft, microphone and camera access, and wider surveillance.
The Scale: 4 Billion Records, 200,000 Sites and Apps
The investigation’s most unsettling finding may be the scale. Citizen Lab analyzed four billion Discover-Tech bidding records and found that during a four-month window, the company’s ads appeared on nearly 200,000 unique websites and Android and iOS apps across dozens of countries.
Millions of devices were also covertly directed to contact Candiru’s servers, which Citizen Lab interprets as likely large-scale tracking and reconnaissance — not every device that saw an ad was infected, but the infrastructure could profile at enormous scale and pick individual devices for exploitation.
Ad impressions even turned up on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission, and the International Criminal Court. An ad appearing on a network does not mean that organization was infected — but it shows that ordinary advertising infrastructure can reach people working in environments where their identities, communications, and device activity have serious intelligence value.
How Is This Different From Other Spyware Attacks?
Classic mercenary spyware campaigns usually require either a one-click infection (a malicious link sent by text or email) or a zero-click exploit sent directly to a device, typically targeting a specific phone’s messaging app. Both depend on the attacker knowing how to reach the target directly.
AdFection changes the delivery model entirely. Instead of sending something to the victim, the attacker rides on advertising auctions that already happen billions of times a day, everywhere, with no action required from the victim. In the researchers’ phrasing: a normal-looking ad loads, and if you are a target, you are infected.
This also widens who can be reached. Discover-Tech is linked to spyware and intelligence threat actors beyond Candiru, including Intelos and Bindecy, according to the report. A separate threat actor, which Citizen Lab calls DARK CARTOGRAPHER, is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers — a mass de-anonymization capability the lab says it will detail in a separate forthcoming report.
What Can You Actually Do About It?
Citizen Lab’s researchers are blunt: because the attack arrives through a service people and organizations routinely allow, traditional defenses — suspicious-link awareness, email attachment filters, even up-to-date software — do not fully cover this route. One concrete recommendation stands out: block ads.
Practical steps for individuals:
- Use a reputable ad blocker in your browser and a system-level ad blocker or DNS-based blocker on mobile devices.
- Keep your browser, operating system, and apps updated — AdFection’s chain still depends on browser exploits at the end of the delivery path.
- Limit advertising identifiers where possible: reset or disable ad tracking IDs on iOS and Android.
- Use a browser with strong tracking protection and consider script-blocking for high-risk browsing.
For organizations, the report is a prompt to treat advertising traffic as untrusted network input. Network-level blocking of ad domains, DNS filtering, and endpoint ad-blocking reduce the attack surface. Security teams should also note that the way spyware vendors plug into the ad ecosystem had remained largely secret until now — which means this report may be describing one discovered pipeline among several.
The Bigger Picture: Why This Matters Beyond Al Jazeera
Mercenary spyware has steadily industrialized over the past decade — a trend visible everywhere from the zero-day markets exploited in competitions like Pwn2Own Ireland 2026 to state-linked campaigns such as the BeyondTrust zero-day attributed to suspected Chinese espionage actors. AdFection represents the next step: spyware vendors no longer need to own the delivery infrastructure at all. The global advertising system — the most pervasive software distribution channel on earth — can be rented as a weapon.
Citizen Lab is calling on regulators to investigate whether Discover-Tech and Candiru, rebranded as Integrity Labs, broke applicable laws. The lab also notes that Discover-Tech leveraged GDPR consent frameworks to target users inside the European Union, which raises questions about whether Europe’s privacy rules can reach this kind of abuse.
As with the recent rogue AI agent disclosures, the deeper lesson is about trust boundaries: every piece of third-party code a device executes — an email attachment, an ad impression, an agent’s web call — is a potential attack path. The AdFection report shows one of those paths had been weaponized for years before anyone proved it publicly.
Frequently Asked Questions
What is AdFection?
AdFection is the name Citizen Lab gave to a technique that delivers mercenary spyware through targeted online ads. The infection begins the moment the ad renders on a device — no click or download is required — making it a zero-click attack delivered via the advertising ecosystem.
Who was targeted in the attacks Citizen Lab confirmed?
At least 45 devices belonging to the international news network Al Jazeera were targeted in 2024 and 2025. Citizen Lab attributes the attacks with high confidence to Candiru (now Integrity Labs) spyware delivered through Discover-Tech advertisements.
Can a regular ad I see infect my device?
Only in the narrow circumstances of a targeted campaign: the ad must identify you as a selected target, and your device must have an exploitable browser or system vulnerability at the end of the chain. Most people are not targets, but the infrastructure exists and can reach any device that renders ads.
How do I protect myself from AdFection-style attacks?
Block ads at the browser and system level, keep your browser and operating system fully updated, and limit or reset advertising identifiers on your devices. These steps cut off the delivery path Citizen Lab documented.
Was Discover-Tech acting alone?
No. Citizen Lab links Discover-Tech to mercenary spyware and intelligence actors beyond Candiru, including Intelos and Bindecy, and separately identified a threat actor called DARK CARTOGRAPHER using its infrastructure to link advertising IDs with phone numbers through mobile carrier vulnerabilities.