GoKawiilResearchers detail 'AdFection' zero-click spyware ads used against Al Jazeera devices
Security researchers say devices at Al Jazeera were infected with Candiru spyware (rebranded 'Integrity Labs') through targeted online ads, a technique they call AdFection. They identify Israeli firm Discover-Tech as the buyer of the malicious ads, running a platform called Controlium that can de-anonymize and infect devices automatically when an ad loads, with analysis of four billion bidding records showing ads served across nearly 200,000 sites and apps.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest advertising networks can be weaponized as a zero-click infection vector, which could complicate efforts to defend against spyware since no user interaction is needed. Researchers say Discover-Tech's infrastructure links to multiple surveillance vendors beyond Candiru, including Intelos and Bindecy, and to a separate actor they call DARK CARTOGRAPHER exploiting carrier vulnerabilities to deanonymize users at scale—pointing to a broader ecosystem of commercial tracking tools that may be harder to attribute and regulate.
- Al Jazeera devices were reportedly infected with Candiru spyware via targeted ads, a technique dubbed AdFection.
- Israeli firm Discover-Tech allegedly facilitated the ad-based attacks through its Controlium platform, linked to multiple spyware vendors.
- Researchers plan a separate report on DARK CARTOGRAPHER, an actor allegedly using the same infrastructure to mass-deanonymize users via carrier vulnerabilities.
YubiKey 5 Series Security Key — With zero-click spyware now being delivered through targeted ads, hardware-based security measures like a YubiKey can help lock down accounts and reduce exposure to account takeovers that often follow device compromise. It's a simple, practical step toward better operational security for journalists and privacy-conscious users facing sophisticated surveillance threats.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: citizenlab.ca, 2026-10-15
Published there as: “Zero-Click Spyware Delivered via Targeted Ads: AdFection”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.