AdFection Zero-Click Spyware Infects Al Jazeera Devices via Targeted Online Ads

Citizen Lab researchers have published technical evidence showing that mercenary spyware can be installed on devices simply by displaying an online advertisement. This zero-click attack vector bypassed traditional user interaction requirements, affecting staff at international news organizations.

What happened

The campaign, termed AdFection, utilized the Discover-Tech advertising infrastructure to deliver payloads linked to Candiru, now Integrity Labs. According to Citizen Lab, at least forty-five Al Jazeera devices were compromised between 2024 and 2025. Network logs revealed that infected systems contacted Discover-Tech servers immediately after an ad loaded. These systems then connected to Candiru validation servers for device checks before establishing command-and-control links.

Discover-Tech presented itself as an advertising firm but facilitated connections between ad markets and commercial spyware groups. Its Controlium platform enabled targeting via mobile advertising IDs, browser cookies, and IP addresses. When an ad loaded, embedded code contacted a Discover-Tech server to verify if the visitor was a target. If matched, the server returned JavaScript that initiated the infection process without any click.

The attack leveraged standard ad industry practices, including real-time bidding and third-party tracking scripts. Researchers analyzed approximately four billion bidding records from 2026. Discover-Tech ads appeared on nearly two hundred thousand websites and apps globally. Millions of devices were directed toward Candiru-linked servers for potential tracking, though viewing an ad did not guarantee infection.

Why it matters

This incident demonstrates the risk inherent in modern advertising ecosystems that rely on complex, third-party code execution. The ability to target specific individuals using standard advertising identifiers allows attackers to bypass perimeter defenses. Security teams must recognize that legitimate ad networks can be abused to deliver sophisticated malware. The scale of the operation suggests that many organizations may have been exposed without realizing it.

What to watch

• Monitor for unexpected connections to known spyware infrastructure, such as Candiru or Integrity Labs servers.
• Review ad network traffic for anomalies in JavaScript execution or unusual data payloads.
• Check for devices communicating with Discover-Tech infrastructure, particularly if they are high-value targets.

Signals worth monitoring

Security operations teams should inspect network logs for outbound connections to advertising domains that occur without direct user navigation. Teams usually look for JavaScript files loading from unexpected sources within ad containers. Check whether endpoints are initiating handshake sequences with validation servers shortly after ad impressions. Look for persistent connections to command-and-control nodes that follow these initial checks. Containment moves typically involve isolating affected hosts and blocking communication with identified malicious infrastructure.

Background: Spyware

Spyware enters systems through overlooked configuration errors. These include disabled update mechanisms, excessive local administrator rights, unverified script execution, and weak process integrity levels. Fix each by enforcing least privilege, restricting execution sources, and isolating sensitive data from general user processes.

Read the full guide: 7 Configuration Mistakes That Invite Spyware Into Your System

What to do and how to stay safe: AdFection

• Audit your organization's ad filtering policies to block known malicious advertising networks.
• Implement strict sandboxing for browsers to limit the execution privileges of ad-related scripts.
• Monitor network traffic for connections to advertising infrastructure that do not align with user activity.
• Review endpoint logs for unexpected process spawns or network connections following ad loads.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does AdFection infect devices without clicking?

The method uses JavaScript embedded in ads to contact a server that checks device identifiers and delivers malware if the device matches a target profile.

Which organizations were affected by this campaign?

Citizen Lab confirmed that at least forty-five devices at Al Jazeera were infected during 2024 and 2025.

What role did Discover-Tech play in the attack?

Discover-Tech acted as an intermediary, using its Controlium platform to target specific devices and deliver the initial malicious code through its ad network.