Key points
- Citizen Lab traces 45 infections at Al Jazeera to Discover-Tech ads in 2024 and 2025.
- The operation used real-time bidding data to serve malicious content to specific devices.
- The spyware vendor Candiru, now Integrity Labs, was linked to these deliveries.
The attacker gains persistent access to target devices without the victim interacting with any malicious link or file. This outcome relies on abusing legitimate advertising infrastructure to identify and serve harmful content. The attacker needed access to real-time bidding data to pinpoint specific victims and a partner willing to deliver the payload through standard ad networks.
In plain English
A technique called AdFection turns online advertising systems into a delivery mechanism for surveillance software. Users do not need to click on an advertisement or download a file. Simply loading a webpage or opening an application is sufficient to trigger the installation. This method bypasses typical user caution because the delivery channel appears to be normal digital advertising.
The background
Citizen Lab researchers identified this as the first publicly confirmed case of zero-click mercenary spyware delivered via targeted ads. They traced attacks against 45 devices at Al Jazeera news outlet to this method. The infections occurred during 2024 and 2025. The spyware used was developed by Candiru, an Israeli firm now operating as Integrity Labs.
What changes now
Discover-Tech, an Israeli adtech company, is accused of acting as a middleman between advertising networks and spyware vendors. Researchers describe the company as a front for large-scale ad espionage abuse. Its Controlium platform allegedly used device and location data from real-time bidding to serve malicious ads. The operation reportedly enjoyed Google’s seal of approval while facilitating these attacks.
The attacker's path
Security teams usually monitor for anomalous traffic spikes associated with ad delivery domains. Check whether your filtering policies treat all ad network traffic as equally trusted. This technique serves the initial access stage of an intrusion by leveraging trusted third-party services. Verify that your endpoints inspect traffic from advertising partners for known malicious signatures.
What to do and how to stay safe: Discover-Tech
- Review network logs for connections to known advertising technology domains, especially those linked to real-time bidding.
- Ensure endpoint detection and response tools are configured to flag process creations originating from web browsers.
- Monitor for unusual outbound connections that do not match normal application behavior patterns.
- Verify that your security filters are not whitelisting all traffic from major advertising networks without inspection.
Step-by-step guide: Ransomware Recovery Plans: 6 Misunderstandings That Block Restoration
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which organization was targeted in this attack?
Al Jazeera was targeted, with researchers tracing infections to 45 of its devices.
What company facilitated the spyware delivery?
Discover-Tech, an Israeli adtech firm, allegedly served as the bridge between advertisers and spyware vendors.
Did users need to click on the ads?
No, the attack was zero-click, meaning simply opening a website or app was enough to trigger the infection.
