Researchers at the Citizen Lab and the ad-security firm Confiant have documented what they describe as the first publicly confirmed, technically documented case of zero-click mercenary spyware delivered through online advertising. The campaign, named AdFection, infected at least 45 Al Jazeera devices and ran through ad platforms that vetted and approved the company behind it for years.
How Discover-Tech Ads Selected Targets Without Carrying Malicious Code
The two organizations published parallel reports on October 15. The ads originated from Discover-Tech, an Israel-based firm that presents itself as a legitimate advertising company. Citizen Lab concluded that it appears to be a front that bridges ad vendors and spyware makers. Its platform, called Controlium, exploits real-time bidding data to identify targets.
The delivery mechanism was built so that the ad itself looked harmless. Each ad carried code that sent the device’s advertising ID and IP address to a Discover-Tech server. If the server judged the device to be a target, it returned attack code. Because the ad contained nothing malicious, ad networks had nothing to detect. Citizen Lab did not recover the browser or app exploit that completed the infection.
Candiru Linked to 45 Al Jazeera Devices With High Confidence
Citizen Lab tied the infection of at least 45 Al Jazeera devices during 2024 and 2025 to Candiru, which has reportedly become Integrity Labs after a 2025 asset sale. The attribution rests on Al Jazeera’s traffic logs and on a Windows file that matches a Candiru tool the lab analyzed in 2021. The researchers did not name the government behind the operation. Al Jazeera journalists were previously targeted with NSO Group’s Pegasus in 2020.
Billions of Bids and Hundreds of Thousands of Placements
The scale of the ad traffic is large. Citizen Lab analyzed nearly four billion Discover-Tech ad bids recorded between March and June 2026. Ads carrying the callback code ran in roughly 70,000 to 75,000 mobile apps and 120,000 websites, though sources vary, and one report puts the figure near 200,000 unique websites. Confiant estimates the traffic at close to 10 million ads a day.
Ads Reached NATO, UN and Defense Networks, but No Infections Were Found
Ads also appeared on sensitive networks, including NATO, the UN, EU bodies, the US Department of Defense, Estonia’s RIA, the IAEA and the International Criminal Court. Researchers found no evidence that any of those organizations were infected. Confiant said the ads it could tie directly to Candiru were low in volume and mostly reached home and mobile connections.
Dark Cartographer and the Carrier-Weakness Tracking Layer
Citizen Lab also identified a second actor, Dark Cartographer, that uses the same platform to link advertising IDs to phone numbers by abusing weaknesses in mobile carrier systems. That activity dates to 2019. Discover-Tech itself was registered in 2020 and has enabled mercenary spyware since at least 2024.
Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020, meaning the firm sat inside the industry’s vetting framework for roughly six years while the infrastructure operated.
Ad Platforms Cut Off Discover-Tech After Researchers Shared Findings
In early October, after the researchers shared their findings, several platforms acted. Google terminated Discover-Tech’s access to its ad exchange, IAB Europe suspended it, Beeswax removed it, Vungle paused it and Eskimi blocked its accounts. Citizen Lab called on regulators to investigate and sanction Discover-Tech. Discover-Tech, Candiru and Al Jazeera did not respond to requests for comment.
The case shows target selection running through the commercial bidding system. In AdFection, the same data flows that decide which advertisement a person sees also decided who received an infection attempt. The unrecovered exploit means researchers cannot yet say which software flaw completed the compromise, an open question that affects how browser and app vendors can respond.
