Spyware from the Israeli firm Candiru has been linked to a series of zero-click attacks on devices at the global news organization Al Jazeera, according to a report by Citizen Lab, a Canadian internet watchdog. These attacks were facilitated through targeted advertisements.
The AdFection Operation
In a campaign dubbed AdFection, Israeli company Discover-Tech used ads to de-anonymize, fingerprint, and infect devices, allowing threat actors to monitor millions of users. Discover-Tech’s involvement in Real-Time Bidding (RTB) auctions enabled it to serve ads containing malicious code to specific targets.
Ad exchanges, which collect extensive user data, typically use this information for user tracking and ad performance. However, these platforms can also deploy spyware by embedding malicious code in ads, as noted by Citizen Lab.
Discover-Tech’s Alleged Espionage Role
Citizen Lab suggests that Discover-Tech is potentially a front for a large espionage campaign, acting as an intermediary between legitimate ad vendors and those selling mercenary spyware. Its platform, Controlium, is capable of de-anonymizing users and executing zero-click hacks when ads are displayed.
The firm is believed to collaborate with multiple mercenary partners, confirmed through its activities linked to profiling and infecting users for Candiru, a well-known Israeli spyware vendor. Some of Discover-Tech’s ads automatically connect to its infrastructure, executing code based on user identifiers.
Impact and Industry Response
Between 2024 and 2025, at least 45 devices at Al Jazeera were targeted using the AdFection campaign, linked directly to Candiru’s spyware. Citizen Lab identified a server exposing four billion ad bid records, confirming Discover-Tech’s extensive reach across nearly 200,000 websites and applications.
In response to these findings, major industry players, including Google and IAB Europe, have removed Discover-Tech from their ad vendor registries. Additional measures were taken by companies such as Beeswax and Eskimi to block its access to ad exchange platforms.
Looking Ahead
Citizen Lab emphasizes the importance of blocking targeted ads at the gateway level as a defense against such threats until the industry can effectively counter AdFection-style vectors. The revelations underscore the growing challenges in cybersecurity and the need for robust protective measures.
