Saturday 17 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Zero-click attacks via targeted ads delivered Candiru spyware to Al Jazeera, researchers find

Citizen Lab documents first public technical confirmation of spyware delivery through ad ecosystem

By LineZotpaper
Published
Read Time2 min
Researchers at Citizen Lab have documented a zero-click attack technique, dubbed AdFection, that used targeted online advertisements to deliver Candiru spyware to devices at Al Jazeera Media Network. The attacks, which occurred between 2024 and 2025, required only the rendering of malicious ads on the victim's device, marking the first public technical confirmation of mercenary spyware delivered through targeted ads.

According to Citizen Lab, the intermediary Discover-e-Tech, an Israeli firm described as a "bridge between mercenary spyware companies and the advertising ecosystem," facilitated the attacks. Discover-e-Tech purchased ad placements through mainstream ad networks and embedded JavaScript that contacted its NOAS server when rendered. Using parameters such as IP address and ad identifiers, the server determined if a target was eligible to receive malicious code, while other devices received nothing to maintain stealth.

Al Jazeera provided Citizen Lab with evidence of attacks targeting at least 45 devices. Network logs showed a sequence from Discover-e-Tech's infrastructure to Candiru validation servers and then to spyware command-and-control servers. Researchers also recovered a DLL file from a compromised Windows system and attributed it to Candiru with high confidence.

A similar method, called Aladdin, was documented in late 2025 by Amnesty International, involving ads that infected targets with Predator spyware. However, AdFection was caught in real attacks rather than from leaked documents.

Candiru is an Israeli spyware vendor that sells surveillance tools, officially to governments only.

§

Analysis

Why This Matters

  • Confirms that spyware can be delivered through legitimate advertising networks without user interaction, expanding the attack surface for targeted surveillance.
  • The targeting of Al Jazeera, a major media network, raises concerns about press freedom and the use of spyware against journalists.
  • The involvement of an intermediary that bridges spyware firms and ad ecosystems suggests a growing market for such capabilities.

Background

Mercenary spyware companies like NSO Group and Candiru have faced sanctions and scrutiny for their tools being used against civil society. Zero-click attacks are particularly dangerous because they require no victim action. The new AdFection technique shows how spyware operators can leverage the online advertising supply chain to reach specific individuals.

Key Perspectives

[Citizen Lab]: The researchers provided the first technical confirmation of spyware delivered via targeted ads, highlighting the role of Discover-e-Tech as a bridge entity. [Journalists and civil society]: The targeting of Al Jazeera underscores ongoing risks for media organizations, especially those covering sensitive geopolitical issues. [Skeptics/Defenders]: Spyware vendors claim they sell only to governments for lawful investigations, but such attacks often lack oversight and can target journalists.

What to Watch

  • Whether regulatory actions follow against Discover-e-Tech or the ad networks involved.
  • Further disclosures of similar attacks using ad infrastructure to deliver spyware.
  • Potential responses from Al Jazeera or other affected organizations.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe