Researchers at the Citizen Lab at the University of Toronto have for the first time documented and confirmed a scheme for infecting computers and smartphones with spyware via online advertising without any action on the part of the user. The method, dubbed AdFection, triggers an exploit chain and delivers malicious code simply upon loading a page or launching an app: the user does not need to click a link, tap a banner, or open a file. According to the report, Al Jazeera journalists and staff were targeted using precisely this method between 2024 and 2025.
Attack Mechanics: From Ad Auction to Malicious Code
Specialists' attention was drawn to Discover-Tech, an Israeli digital advertising company. According to Citizen Lab's conclusions, its Controlium platform allowed operators to single out specific individuals for surveillance based on device identifiers and other data automatically transmitted to participants in ad auctions. When an ad was loaded, an embedded script contacted the Discover-Tech server and transmitted device data. If the system identified the visitor as a target, additional infection code was returned; for all others, the server typically returned an empty response. Meanwhile, the user might not even see a suspicious banner, as ads were frequently loaded in the background.
Attacks on Al Jazeera Infrastructure
Analyzing network connection logs, experts traced a characteristic sequence: first, requests to Discover-Tech infrastructure, then to validation servers belonging to spyware developer Candiru, and finally to command-and-control servers of the malware. A Windows DLL library linked to Candiru was discovered on one of the compromised computers. According to the Citizen Lab report, at least 45 devices within the Al Jazeera network were attacked this way in 2024–2025.
Scale of the Ad Network and Pool of Potential Victims
The reach of the advertising network proved incomparably larger than the number of confirmed victims. An analysis of nearly 4 billion ad auction records showed that between March and June 2026, Discover-Tech ads were displayed on more than 120,000 websites and in 70,000 mobile apps. Millions of devices contacted Candiru servers; however, researchers emphasize that this does not imply they were infected: a significant portion of the requests was used for data collection and target selection. Ad impressions were also detected on the networks of government agencies and international organizations.
Context and Industry Response
Malicious actors have long used vulnerabilities in messengers and other apps for zero-click attacks; in December 2025, Apple and Google warned users about targeted spyware campaigns. The AdFection scheme differs in that malicious code is delivered via ad networks, significantly expanding the attack surface. Even before the report's publication, Google blocked Discover-Tech from its ad systems and set up Safe Browsing warnings for related sites. Beeswax ceased cooperation, and industry association IAB Europe suspended Discover-Tech's participation in its vendor registry.
