Zero-click attacks used targeted ads to deliver Candiru spyware

Candiru spyware was provided to gadgets at Al Jazeera Media Network through targeted online ads in a zero-click attack that needed just rendering the harmful advertisements on the victim’s gadget.

Scientists at Citizen Labs examining the attacks described this method as AdFection, keeping in mind that their report is the very first public technical verification of mercenary spyware provided through targeted advertisements.

A comparable approach was recorded in late 2025 by Amnesty International, including advertisements that contaminated targets with Predator spyware without them clicking anything.

That infection system was called Aladdin and emerged due to a collection of marketing files and files dripped from the Intellexa security business that scientists studied and proven with technical information from forensic examinations.

Unlike Alladin, AdFection was captured in genuine attacks and connected to Israeli company Discovere-Tech, explained by Citizen Lab as ” a bridge between mercenary spyware companies and the advertising ecosystem.”

Zero-click Candiru spyware infection

According to Citizen Lab, Discover-Tech enabled its clients to utilize its Controlium platform to target particular gadgets with destructive code, or profile, deanonimize, and finger print user gadgets.

“Discover-Tech appears to work with multiple mercenary spyware, hacking, and advertising vendors, connecting the spyware industry to the online advertising ecosystem,” Person Lab states

The business acquired advertisement positionings through mainstream advertisement networks and exchanges, embedding JavaScript in advertisements that called its “NOAS server” when rendered.

Utilizing several criteria (e.g., IP address, advertisement identifiers), the NOAS server, “or getAd server,” identified if a target was qualified to get JavaScript code.

Picked targets got extra code, while other gadgets the advertisement rendered on gotten absolutely nothing, assisting keep the attacks sneaky.

Al Jazeera offered Citizen Lab with proof of attacks that targeted a minimum of 45 gadgets in between 2024 and 2025. The network logs analyzed by the scientists revealed a series from Discover-Tech facilities to Candiru recognition servers and after that to spyware command-and-control servers.

The scientists likewise recuperated a DLL file from a jeopardized Windows system and associated it with high self-confidence to Candiru, based upon facilities and code overlaps with formerly recorded samples.

Candiru is an Israeli spyware supplier that offers monitoring tools, formally just to federal governments. The business likewise established malware for Windows called DevilsTongue, which can take files, qualifications, and messages.

According to previous reports, its tools have actually been released through Windows and Chrome zero-day exploits versus reporters, activists, political leaders, and other targets.

While Al Jazeera is one verified target of these attacks, Citizen Lab reports that the marketing operation put 3.77 billion quotes and won 442 million auctions in between March and June 2026.

Advertisements evaluated to bring aggressor script tags appeared throughout 75,373 Android/iOS apps and 120,768 sites, although these figures do not represent infection counts.

“We approximate that in between numerous thousands and countless users were directed to these domains by means of Discover-Tech advertisements,” describes Citizen Lab.

After getting Citizen Lab’s reports, significant marketing business like Google, IAB Europe, Beeswax, Eskimi, and Vungle acted to eliminate upseting accounts and obstruct access to domains.