A zero-click spyware campaign has shown how an ordinary online advertisement can become a route into a targeted device. Research published on 15 October 2026 documented infections delivered when an advert rendered, without the victim clicking or opening anything.
Citizen Lab and advertising security company Confiant named the operation AdFection. Their findings connect Israeli advertising company Discover-Tech with targeted advertising infrastructure used to deliver spyware attributed to Candiru, which is now branded Integrity Labs.
How the zero-click spyware campaign worked
AdFection used the programmatic advertising system, through which advertising space is bought and sold automatically in real time. When a person opened a participating website or app, advertisers competed to display an advert based on available targeting data.
Discover-Tech allegedly used this process for more than marketing. Its advertising stack could fingerprint and de-anonymise a device as an advert rendered, assess whether it matched a selected target, and invisibly direct it towards infrastructure controlled by Candiru.
If the device was suitable, Candiru could serve an exploit chain tailored to its software. This made the technique a zero-click drive-by attack: viewing a page or app containing the winning advert could be enough to begin exploitation, with no malicious link for the victim to recognise or avoid.
Discover-Tech operated a platform called Controlium, which supported this targeting and infection workflow. Advertising data such as device identifiers, cookie matching information and other fingerprinting signals could enable the operators to distinguish a particular device from the much larger advertising audience.
Why targeted advertising enabled precise delivery
Programmatic advertising operates at enormous scale, but it can also be highly selective. An attacker able to participate in the bidding process can seek an impression associated with a chosen identifier, location, device profile or browsing context.
After winning the impression, the operator can deliver different content depending on what it learns about the device. In AdFection, the advertised content could appear benign while background requests steered selected systems towards spyware infrastructure.
This conditional approach also makes investigation difficult. Researchers, advertising reviewers and people outside the intended profile may receive a harmless advert rather than the exploit chain, reducing the attacker’s exposure.
AdFection infections and the affected devices
At least 45 Al Jazeera devices were targeted and infected during 2024 and 2025. Several reports identify these systems as Windows computers, although specific Windows editions, browser versions and exploited software builds have not been disclosed.
Despite reports describing hacked phones, confirmed mobile infections have not been established for this campaign. Citizen Lab refers more broadly to devices, while the delivery footprint included websites and apps running on Android and iOS. This demonstrates potential mobile exposure, but it does not prove that Android phones or iPhones were successfully compromised in the documented cases.
No CVE identifiers, public proof of concept or detailed exploit code had been disclosed as of 15 October 2026. It therefore remains unclear which browser, operating system or application vulnerabilities the zero-click spyware exploited at Al Jazeera.
Almost 200,000 websites and apps carried the ads
Analysis of Discover-Tech’s bidding records found that its adverts appeared across almost 200,000 unique websites and Android or iOS apps during a four-month observation period. Millions of devices were covertly directed towards Candiru infrastructure through the associated advertising calls.
That figure does not mean millions of devices were infected. Most may have been assessed, fingerprinted or redirected before being rejected as unsuitable. The confirmed victim set remains far smaller, reflecting the operation’s targeted espionage purpose rather than indiscriminate malware distribution.
Confiant telemetry also placed Discover-Tech adverts on sensitive networks, including those associated with the US Department of Defense, NATO and the International Atomic Energy Agency. Their presence shows the advertising system’s reach, but the available evidence does not establish that those institutions were compromised.
Zero-click spyware investigation timeline
-
2019: Related activity involving Discover-Tech and associated vendors dates back to this year, according to summaries of the research.
-
2024 to 2025: At least 45 Al Jazeera devices were targeted and infected through advertising attributed to the Candiru operation.
-
April 2026: Confiant identified an unusual advert, blocked it for its clients and began investigating the associated infrastructure.
-
Mid 2026: After roughly four months of investigation, Confiant coordinated action intended to cut Discover-Tech off from major advertising platforms.
-
15 October 2026: Citizen Lab published its AdFection research. Google removed Discover-Tech from its advertising platforms, while multiple news organisations reported the findings.
The campaign represents confirmed exploitation in the wild rather than a theoretical advertising weakness. However, restricting Discover-Tech’s platform access should reduce its immediate ability to buy advertising impressions through participating services.
The disruption does not establish that every associated server, customer or route into the advertising ecosystem has disappeared. Limited public indicators also make independent detection challenging. Open reporting describes connections to Discover-Tech domains followed by Candiru infrastructure, but does not provide a complete public list of domains, IP addresses or file hashes.
Why AdFection matters to organisations
AdFection changes the risk associated with malicious advertising. Conventional malvertising often relies on a person clicking a deceptive advert, downloading a file or entering credentials. This zero-click spyware model instead turns the advert-rendering process itself into an intrusion surface.
The capability appears designed for selected surveillance targets, not broad criminal deployment. Even so, executives, journalists, researchers and employees handling sensitive negotiations may fit the profile sought by a well-resourced operator.
The case must also be distinguished from the separate Aladdin advertising vector linked to Intellexa’s Predator spyware in reporting from December 2025. That earlier activity demonstrated a similar concept, but involved a different vendor and campaign. AdFection provides public technical confirmation tied to observed infections.
Actions to reduce exposure to ad-delivered attacks
Because the exploited vulnerabilities and comprehensive indicators remain undisclosed, organisations cannot apply a campaign-specific patch or search reliably for one published signature. Controls should therefore concentrate on reducing the available advertising and exploit surface for higher-risk users.
-
Apply current operating system, browser and in-app webview updates promptly across managed computers and mobile devices.
-
Use mobile device management and endpoint policies to enforce supported software versions and restrict unmanaged browsers.
-
Apply DNS filtering or a secure web gateway to limit unnecessary advertising, tracking and known malicious infrastructure, particularly on sensitive networks.
-
Reduce ad tracking and cross-site identifiers where business applications permit, making precise device selection more difficult.
-
Enable available high-risk or restricted browsing protections for staff whose roles make them plausible surveillance targets.
Security teams should also review unusual browser or webview connections that move rapidly from advertising services to unfamiliar infrastructure. The central lesson from AdFection is specific: trusted websites and legitimate apps can expose users to a zero-click spyware chain when the advertising supply path itself is abused.
Originally reported by Financial Times.
