Candiru spyware infected Al Jazeera devices through no-click advertisements: AdFection
Targeted advertisements delivered Candiru spyware to Al Jazeera devices without a click. Advertising platforms restricted Discover-Tech, but no complete remedy is confirmed. Block ads and seek specialist help if you face targeted surveillance.
Use a trusted browser ad blocker and disable mobile ad tracking to reduce exposure. If your work or public profile puts you at risk of targeted surveillance, ask your security team or a spyware specialist for help; advertising-platform blocks do not clean an infected device.
What’s happening
Citizen Lab’s 15 October investigation confirmed that targeted advertisements delivered Candiru spyware to Al Jazeera devices during 2024–2025 without anyone clicking them. It attributed the advertising delivery to Discover-Tech. At least 45 devices were targeted, and a Windows spyware sample was recovered. MyCERT subsequently described all 45 as infected; Citizen Lab’s primary investigation does not give that infection total. The wider advertising operation reached websites and mobile apps, but advertisement exposure does not establish infection. Google blocked Discover-Tech from its advertising exchanges and added Safe Browsing protections; Beeswax removed it, Liftoff paused access, and IAB Europe suspended its listing. As at 3 November, the reviewed sources identify no specific affected software versions, CVEs or update that conclusively fixes this attack chain. They also provide no confirmation that all compromised devices were cleaned or that the operation has ended. Discover-Tech and Candiru had not responded within Citizen Lab’s stated deadline.
- What
- Breach
- Affects
- Al Jazeera devices; websites and mobile apps displaying Discover-Tech advertisements
- Fixed in
- Nothing to patch
- Since
- 15 Oct 2026
Timeline
- Update
MyCERT published an advisory and reported that two command servers embedded in the recovered Windows spyware sample no longer resolved. It warned that infrastructure could change and recommended forensic examination for people at high risk.
- Made publicNothing to patch
Citizen Lab published AdFection, confirming Candiru infections at Al Jazeera through advertisements requiring no click. At least 45 devices were targeted during 2024–2025; exact attack dates and the total infected were not published.
- Update
Beeswax confirmed it had already removed Discover-Tech from its Buyer Cloud advertising platform following suspicious activity and independent security validation.
- Update
Liftoff said it had paused all Discover-Tech access while reviewing the allegations.
- Update
IAB Europe suspended Discover-Tech from its Global Vendor List after an audit found policy violations. Its subsequent statement distinguished suspension from permanent expulsion.
- Update
An advertisement triggered Confiant’s detection systems, prompting its investigation into Discover-Tech’s device profiling and connections to Candiru infrastructure.
Sources
- Beeswax response to Citizen Lab’s request for commentBeeswax · 13 Oct 2026
- Liftoff response to Citizen Lab’s request for commentLiftoff · 12 Oct 2026
- IAB Europe response to Citizen LabIAB Europe · 15 Oct 2026
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary SpywareCitizen Lab · 15 Oct 2026
- ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity VacuumingConfiant · 15 Oct 2026
- Targeted ads installed Candiru spyware in zero-click attacksBleepingComputer · 16 Oct 2026
- MA-1485.102026: Zero-Click Spyware Delivered via Targeted Online Advertising (AdFection)MyCERT · 22 Oct 2026