--- title: "AdFection: Citizen Lab Confirms Spyware Infection of Devices via Online Advertising Without a Single Click" description: "Citizen Lab has confirmed the AdFection method: Candiru spyware infected devices via online ads without a single click. At least 45 devices on the Al Jazeera network were targeted in 2024–2025." date: 2026-10-17T02:52:30.336Z lang: en url: https://xab.info/en/posts/adfection-spyware-via-ads-without-click tags: [adfection, spyware, citizen-lab, discover-tech, al-jazeera, cybersecurity, candiru] author: "Alexander Buran" publisher: "XAB.info" --- # AdFection: Citizen Lab Confirms Spyware Infection of Devices via Online Advertising Without a Single Click ![Hooded hacker sitting at a computer with source code in the dark](https://xab.info/media/2026/10/17/adfection-shpionskoe-po-cherez-reklamu-bez-klika/adfection-shpionskoe-po-cherez-reklamu-bez-klika-1.webp) ## Key Points - Citizen Lab has for the first time confirmed device infection with spyware via online ads without a single click (the AdFection method). - Discover-Tech's Controlium platform utilized device identifiers from ad auctions to select surveillance targets. - In 2024–2025, at least 45 devices in the Al Jazeera network were attacked; a DLL linked to Candiru was found on one computer. - From March to June 2026, Discover-Tech ads were displayed on 120,000+ websites and 70,000 mobile apps. - Prior to the report's publication, Google blocked Discover-Tech, IAB Europe suspended its participation, and Beeswax halted cooperation. Researchers at the Citizen Lab at the University of Toronto have for the first time documented and confirmed a scheme for infecting computers and smartphones with spyware via online advertising without any action on the part of the user. The method, dubbed AdFection, triggers an exploit chain and delivers malicious code simply upon loading a page or launching an app: the user does not need to click a link, tap a banner, or open a file. According to the report, Al Jazeera journalists and staff were targeted using precisely this method between 2024 and 2025. ### Attack Mechanics: From Ad Auction to Malicious Code Specialists' attention was drawn to Discover-Tech, an Israeli digital advertising company. According to Citizen Lab's conclusions, its Controlium platform allowed operators to single out specific individuals for surveillance based on device identifiers and other data automatically transmitted to participants in ad auctions. When an ad was loaded, an embedded script contacted the Discover-Tech server and transmitted device data. If the system identified the visitor as a target, additional infection code was returned; for all others, the server typically returned an empty response. Meanwhile, the user might not even see a suspicious banner, as ads were frequently loaded in the background. ### Attacks on Al Jazeera Infrastructure Analyzing network connection logs, experts traced a characteristic sequence: first, requests to Discover-Tech infrastructure, then to validation servers belonging to spyware developer Candiru, and finally to command-and-control servers of the malware. A Windows DLL library linked to Candiru was discovered on one of the compromised computers. According to the Citizen Lab report, at least 45 devices within the Al Jazeera network were attacked this way in 2024–2025. ### Scale of the Ad Network and Pool of Potential Victims The reach of the advertising network proved incomparably larger than the number of confirmed victims. An analysis of nearly 4 billion ad auction records showed that between March and June 2026, Discover-Tech ads were displayed on more than 120,000 websites and in 70,000 mobile apps. Millions of devices contacted Candiru servers; however, researchers emphasize that this does not imply they were infected: a significant portion of the requests was used for data collection and target selection. Ad impressions were also detected on the networks of government agencies and international organizations. ### Context and Industry Response Malicious actors have long used vulnerabilities in messengers and other apps for zero-click attacks; in December 2025, Apple and Google warned users about targeted spyware campaigns. The AdFection scheme differs in that malicious code is delivered via ad networks, significantly expanding the attack surface. Even before the report's publication, Google blocked Discover-Tech from its ad systems and set up Safe Browsing warnings for related sites. Beeswax ceased cooperation, and industry association IAB Europe suspended Discover-Tech's participation in its vendor registry. ## Fact-Check & Sources - [Шпионское ПО научилось заражать устройства через рекламу без единого клика — достаточно просто открыть сайт window-new](https://3dnews.ru/1149988/shpionskoe-po-nauchilos-zaragat-ustroystva-cherez-reklamu-bez-edinogo-klika-dostatochno-prosto-otkrit-sayt) - Primary source: summary of the Citizen Lab report. Confirms the AdFection method, the role of Discover-Tech/Controlium and Candiru, the number of attacks (45 Al Jazeera devices in 2024–2025), network reach (120k+ sites, 70k apps, March–June 2026), and the reaction from Google/Beeswax/IAB Europe. ## FAQ ### What is AdFection? It is a method of delivering spyware via online advertising without a single click: malicious code runs upon page or app loading, sometimes in the background. ### Who confirmed this method? Researchers at the Citizen Lab at the University of Toronto, after studying connection logs and attack infrastructure. ### How many devices were attacked? According to the Citizen Lab report, at least 45 devices on the Al Jazeera network were targeted this way in 2024–2025. ### What was the scale of the ad network? Between March and June 2026, Discover-Tech ads were shown on over 120,000 websites and 70,000 mobile apps; millions of devices connected to Candiru servers, though not all were infected. ### How did the industry react? Google blocked Discover-Tech in its ad systems and enabled Safe Browsing warnings, Beeswax stopped cooperation, and IAB Europe suspended the company's participation in its vendor registry.