GoKawiilCitizen Lab finds Candiru spyware delivered via targeted ads to Al Jazeera staff
Citizen Lab researchers documented a zero-click technique, dubbed AdFection, that delivered Candiru spyware to Al Jazeera Media Network devices simply by rendering malicious online advertisements. The ads, placed through mainstream ad networks by Israeli firm Discover-Tech using its Controlium platform, contacted a 'NOAS' server that checked device details like IP address before deciding whether to push spyware-loading code to that specific target.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings mark what Citizen Lab calls the first public technical confirmation that mercenary spyware can be distributed through the legitimate online advertising supply chain, suggesting ad networks could become a covert infection vector beyond traditional phishing or exploit links. The report echoes Amnesty International's late-2025 disclosure of a similar ad-based delivery method, called Aladdin, for Predator spyware, indicating this approach may be spreading among surveillance vendors and could complicate efforts to detect or block such attacks.
- Citizen Lab identified 'AdFection,' a zero-click method delivering Candiru spyware via targeted ads to Al Jazeera devices.
- Israeli company Discover-Tech allegedly ran the campaign through its Controlium platform, linking spyware vendors to ad networks.
- The technique resembles 'Aladdin,' an ad-based Predator spyware delivery method previously exposed by Amnesty International.
Source: bleepingcomputer.com, 2026-10-16
Published there as: “Zero-click attacks used targeted ads to deliver Candiru spyware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.