AdFection: Citizen Lab Says Ad Auctions Delivered Candiru Spyware to 45 Al Jazeera Devices

A remote operator who knew a target's advertising ID, cookie ID or IP address could have Candiru spyware delivered to that person's device through an ordinary ad auction, with no click and no visible sign. Citizen Lab published its evidence on October 15, 2026, in Report 195, "Exposing AdFection", authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert.

It calls the case the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. No CVE is attached to the delivery route, so there is nothing to patch against it.

How an ad becomes an exploit

Citizen Lab describes four steps. Discover-Tech, an Israeli company registered in March 2020, wins an auction and its ad renders in an app or a website, sometimes in the background. An embedded script tag contacts a Discover-Tech server the report calls NOAS, sending a cookie or mobile ad ID plus the device's public IPv6 address. The server decides, apparently from the source IP and identifiers, whether to answer. Most visitors get a 0-byte response. A selected target gets JavaScript that can load further code, such as a browser exploit.

The report adds a detail that explains the ad industry's blind spot: the company never directly shares malicious code, or pointers to it, with the ad vendors that serve the ad.

What was confirmed at Al Jazeera

Al Jazeera Media Network supplied logs showing that at least 45 of its devices were targeted in 2024 and 2025, BleepingComputer reported. The logs show a sequence: Discover-Tech infrastructure, then a Candiru validator server, then a Candiru command-and-control server. Citizen Lab also analysed a Windows DLL from a compromised machine and attributes it to Candiru, which now trades as Integrity Labs, with high confidence. The sample shares a COM hijack for persistence, 48-byte XOR obfuscation and connectivity-check domains with Candiru's 2021 chain.

The report says attribution of infections is high confidence, not proven for every targeted device. Forty-five is a count of targeted devices.

Scale: 196,141 apps and sites, mostly harmless

For March to June 2026, data from Discover-Tech's ad-buying platform, MyDSP, shows 3,770,286,576 bids and 441,954,291 won impressions, an 11.7% win rate. At least 718,748,885 bids, about 19%, involved ads carrying the NOAS script tag. Those ads were shown in 75,373 apps and 120,768 websites, across IP addresses in 161 countries.

1. Websites121K count
2. Apps75K count

Source: Citizen Lab, Report 195 'Exposing AdFection', October 15, 2026

The report's key findings say "almost 200,000" sites and apps; the body figures add to 196,141, so the two are consistent. Citizen Lab estimates that between hundreds of thousands and millions of users were directed to the domains. An impression is not an infection, and the authors stress that an impression on a sensitive network does not confirm targeting.

The spend was small: about $109,091, with revenue and conversion fields at zero. The advertisers were mostly Discover-Tech-linked entities, which fits a platform built to deliver code and not to sell anything.

Impressions appeared on networks of NATO, the United Nations and EU institutions, critical infrastructure in the Nordic countries and Australia, and government bodies in about two dozen countries, Citizen Lab said.

Who else touches the platform

Discover-Tech's customer console, Controlium, lets users target individuals by mobile ad ID, browser ID or IP address and push "controlled ads". Citizen Lab found Candiru users logged into it, and ad-link data inside Candiru infection links that decrypted to an IP address registered to the Saudi Ministry of Foreign Affairs. That address does not on its own show who ran the operation.

The report also ties at least 15 Controlium users to Intelos and connects Bindecy through infrastructure and products called Archer and Cupid. Bindecy and Intelos did not respond in time, along with Xandr.

The console had its own flaw. Its authentication logic ignored the signed Auth0 token, and an unauthenticated endpoint exposed login logs covering 128 days and 120 usernames. The authors did not exploit it. The Druid databases behind the platform were shut down in August 2026, so some of the data Citizen Lab could use is incomplete.

What the ad industry did

The responses came in early October, after Citizen Lab shared findings. Per the report, Google and IAB Europe removed Discover-Tech from their vendor registries and Google ended its ad exchange access. Beeswax removed the company from its platform, Vungle (Liftoff) paused access, and Eskimi blocked its accounts and domains.

Amnesty International had documented a similar ad-based route delivering Predator spyware in late 2025, BleepingComputer said, so this is a pattern and not a one-off.

This desk's recent stories, such as the PAN-OS management interface bug, involve perimeter appliances that can be patched. AdFection is the opposite case, closer to the Broadcom Wi-Fi bug with no CVE: a route that does not appear in any scanner.

Citizen Lab calls on regulators to investigate Discover-Tech and Candiru, or Integrity Labs, for possible legal violations. Its report names a fourth actor, DARK CARTOGRAPHER, which uses mobile-network flaws to link ad IDs to phone numbers across more than 30 countries, and says a separate report is forthcoming.