Candiru spyware reached Al Jazeera through zero-click ads

Citizen Lab says the mercenary spyware vendor Candiru infected devices at Al Jazeera using ordinary online ads, with no click or user action required. The primary source is Citizen Lab Report 195, Exposing AdFection (October 15), published alongside a technical investigation by ad-security firm Confiant. The researchers call it the first public, technical confirmation that targeted advertising was used as a delivery pipeline for zero-click spyware.

What happened

At least 45 devices inside Al Jazeera were targeted in 2024 and 2025. Citizen Lab links the activity to Candiru — a vendor the report says has rebranded as "Integrity Labs" — with high confidence, based on infrastructure fingerprinting and on a recovered Windows sample it assesses to be a newer build of the Candiru attack chain it documented in 2021. The sample reused a COM-hijack persistence method, a 48-byte repeating XOR key scheme, and the same connectivity-check domains.

The delivery vehicle is a company called Discover-Tech, which Citizen Lab describes as an Israeli firm presenting itself as a legitimate ad vendor while acting as a bridge between ad exchanges and spyware operators. Its platform, Controlium, lets a customer target a specific person by mobile advertising ID, browser ID, or IP address.

How the zero-click chain works

The ad itself carries no exploit — which is why the networks displaying it had nothing malicious to detect:

1. A Discover-Tech ad includes a script tag pointing to what the report calls a NOAS server.
2. When the ad renders, it sends the viewer's ad identifiers to Discover-Tech.
3. The NOAS server decides, from the IP and identifiers, whether to return JavaScript or an empty response. A non-target gets nothing.
4. A targeted device is handed off to a Candiru validator server, then to a command-and-control server. The report says displaying the ad to a targeted device can be enough to begin infection.

Citizen Lab stresses the limit of its own telemetry: a Discover-Tech ad impression does not by itself confirm targeting or infection.

Scale and reach

Confiant's analysis found Discover-Tech ads ran across roughly 200,000 apps and websites over a four-month window (March–June 2026), drawn from about four billion bidding records. Upstream exchanges feeding the platform included Google, Yandex, Vungle (Liftoff), and Sunteng; buying and ID-syncing ran through Beeswax (FreeWheel/Comcast), Eskimi, and Microsoft's Xandr. Confiant reported the ads reached networks of major government entities, including the U.S. Department of Defense — reach, not confirmed compromise.

Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026, and Google terminated its access to its ad exchanges.

Indicators

Citizen Lab and Confiant published IOCs. The recovered Candiru sample:

SHA-256  255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8
C2       fearevolve[.]com, jobmarcher[.]com
C2       insightenterprisells[.]com, plasticbells[.]com
Valid.   keyadapter[.]com, sharethere[.]net

The full indicator set, including Discover-Tech infrastructure (controlium[.]net, powerium[.]net, myipinfo[.]io, ppv2[.]mtrtb[.]com), is in the Citizen Lab report and the Confiant writeup.

What to do

1. High-risk users — journalists, dissidents, their contacts — should treat a modern, well-maintained mobile device and prompt OS updates as baseline, and consider lockdown-style modes that cut exposure to browser and ad rendering.
2. Enterprise defenders should run the published domains and hash against DNS, proxy, and EDR telemetry, and look at ad-heavy browsing paths rather than only email.
3. Block ads at the network layer. Citizen Lab researcher John Scott-Railton's blunt advice is to block ads now; it removes the delivery surface this chain depends on.

Context

Al Jazeera is a repeat target — NSO Group's Pegasus hit its journalists in 2020 through a zero-click iMessage exploit. The through-line from Pegasus to AdFection is the same business model, surveillance-for-hire, sold to government customers and reached, this time, through the ad-tech supply chain rather than a messaging bug. The novel part is the attribution of a zero-click infection path to the advertising ecosystem itself.