New research from **Citizen Lab** has unveiled a novel and alarming method for deploying mercenary spyware: targeted online advertisements. Dubbed 'AdFection,' this zero-click attack vector allowed **Candiru** spyware to infect devices at **Al Jazeera Media Network** simply by displaying a malicious ad. ### The AdFection Mechanism AdFection represents the first public technical confirmation of mercenary spyware delivery via targeted ads. A similar, though distinct, method known as 'Aladdin' was previously documented by **Amnesty International** in late 2025, involving **Predator** spyware. However, AdFection was observed in live attacks and directly linked to **Discovere-Tech**, an Israeli firm described by **Citizen Lab** as a crucial 'bridge between mercenary spyware companies and the advertising ecosystem.'  **Discovere-Tech**'s platform, **Controlium**, allowed customers to target specific devices for malicious code delivery, profiling, deanonymization, and fingerprinting. The company procured ad placements through mainstream ad networks, embedding JavaScript within the ads. When rendered, these ads contacted **Discovere-Tech**'s 'NOAS server.' ### Surgical Targeting and Stealth Using parameters like IP addresses and ad identifiers, the NOAS server determined if a device was a designated target. Only eligible targets received additional malicious JavaScript code, while other devices rendering the ad received nothing. This selective delivery mechanism made the attacks incredibly stealthy and difficult to detect.  **Al Jazeera** provided **Citizen Lab** with evidence of attacks targeting at least 45 devices between 2024 and 2025. Network logs clearly showed a progression from **Discovere-Tech**'s infrastructure to **Candiru** validation servers and subsequently to spyware command-and-control servers. ### Candiru's Persistent Threat Researchers also recovered a DLL file from a compromised Windows system, confidently attributing it to **Candiru** based on infrastructure and code overlaps with previous samples. **Candiru** is an Israeli spyware vendor known for selling surveillance tools, officially to governments. The company previously developed Windows malware named **DevilsTongue**, capable of exfiltrating files, credentials, and messages.  Past reports indicate that **Candiru**'s tools have been deployed against journalists, activists, and politicians using Windows and **Chrome** zero-day exploits. ### Widespread Exposure, Targeted Infections While **Al Jazeera** is a confirmed target, **Citizen Lab**'s findings suggest a much broader potential exposure. The advertising operation placed 3.77 billion bids and won 442 million auctions between March and June 2026. Ads containing attacker script tags appeared across 75,373 Android/iOS applications and 120,768 websites. **Citizen Lab** estimates that 'between hundreds of thousands and millions of users were directed to these domains via **Discovere-Tech** ads,' though these figures do not represent actual infection counts. Following **Citizen Lab**'s disclosures, major advertising entities, including **Google**, **IAB Europe**, **Beeswax**, **Eskimi**, and **Vungle**, have taken swift action to remove offending accounts and block access to associated domains.