AdFection: zero-click Candiru spyware delivered through targeted online ads

Citizen Lab and the ad security firm Confiant published parallel investigations on October 15 describing a technique they call AdFection, which they describe as the first publicly confirmed case of mercenary spyware reaching devices through targeted online ads with no click required. The reports say Israeli ad firm Discover-Tech used its Controlium platform to profile devices by advertising ID, IP address, and fingerprint during real time ad auctions, and to route selected targets to validator and exploit servers for Candiru spyware when an ad rendered.

Citizen Lab linked the activity with high confidence to infections on at least 45 devices at Al Jazeera in 2024 and 2025, based in part on network logs the broadcaster shared. The researchers reviewed nearly four billion bidding records from March to June 2026 and found Discover-Tech ads on about 120,000 websites and about 70,000 apps. Google, IAB Europe, Beeswax, and other ad platforms have since removed or blocked Discover-Tech.

Sources: Reuters, The Register, The Hacker News