Citizen Lab Details AdFection, an Ad-Based Zero-Click Spyware Attack on Al Jazeera Devices
Ad delivery is built to let buyers select individual devices by advertising identifier and IP address, so the same mechanism that narrows an audience can narrow a target list, and Citizen Lab's technical evidence puts that reach on the record.
Reporting from 1 source: GIGAZINE.
Citizen Lab says an Israeli advertising company, Discover-Tech, used its Controlium platform to deliver spyware to specific devices through ordinary online ads, with no click or download required. At Al Jazeera, at least 45 devices were targeted between 2024 and 2025, and some were infected with spyware made by the Israeli firm Candiru. The government or organization behind the order is not identified.
Citizen Lab found that infected Al Jazeera devices connected to Discover-Tech's server first, then reached the attacker's command server through Candiru's infrastructure. Attack code is not sent to devices outside the target set, which makes the delivery harder for ad-inspecting security systems to catch. Analyzing roughly 4 billion of Discover-Tech's ad bidding records, Citizen Lab says the company's ads appeared on about 200,000 websites and apps across dozens of countries over four months, and that millions of devices were made to connect to Candiru's server through ads.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.