An advertisement appearing on a screen can be enough to deliver spyware. No suspicious link to click, no attachment to open.
That is the finding of an investigation by the University of Toronto’s Citizen Lab, which uncovered how online advertising infrastructure was used to track devices and deliver spyware, including in attacks on journalists.
Citizen Lab calls the technique "AdFection" and says its investigation provides the first public technical confirmation of mercenary spyware being delivered through targeted ads without any interaction from the victim.
The investigation centers on Discover-Tech, an Israeli advertising technology company, and Candiru, an Israeli mercenary spyware maker rebranded as Integrity Labs.
The US Commerce Department placed Candiru on its trade blacklist in November 2021, saying it supplied spyware to foreign governments that used it to target journalists, activists, officials and others maliciously.
Earlier that year, Microsoft, working with Citizen Lab, identified more than 100 victims of spyware linked to the company.
According to Citizen Lab, Discover-Tech gave spyware operators access to a system built to find particular audiences across the internet. The same tools used to put an advertisement in front of a potential customer could put malicious code in front of a surveillance target.
The reach was extensive. Researchers examined nearly 4 billion advertising bidding records from March to June 2026 and found Discover-Tech ads appearing on more than 120,000 websites and over 70,000 mobile applications worldwide.
Here is what the investigation uncovered, how the attacks worked and why the findings extend far beyond one newsroom.
Citizen Lab identified at least 45 devices at Al Jazeera targeted in attacks during 2024 and 2025, linking the operation with high confidence to Candiru spyware delivered through Discover-Tech advertisements.
Researchers confirmed infections, but the figure of 45 refers to devices targeted, not a confirmed total of successful compromises.
Network logs supplied by Al Jazeera allowed researchers to reconstruct how the attacks unfolded.
First, a device loaded a website or application carrying a Discover-Tech advertisement. The ad could appear on screen or load in the background, without the user clicking it.
Online advertisements can contain software code alongside their visible images or videos. In this case, that code contacted Discover-Tech’s servers, supplying information that could help identify the device, including advertising identifiers and its public IP address.
The server then assessed whether the device matched the attacker's criteria. For most viewers, it returned no additional code. But for selected targets, it returned additional code that connected the device to Candiru’s infrastructure.
Citizen Lab did not rely solely on the advertising infrastructure when linking the attack to Candiru.
Researchers identified technical fingerprints associated with Candiru's infrastructure and found hundreds of domains and IP addresses matching those characteristics.
They also examined a malicious software file recovered from one compromised Windows device. It contained server addresses matching the Candiru infrastructure they had identified, alongside technical similarities to a Candiru attack documented in 2021.
Together, that evidence allowed Citizen Lab to link the attacks to Candiru with high confidence.
The potential intrusion goes well beyond tracking someone’s browsing. In its earlier investigation, Citizen Lab described Candiru spyware marketed as capable of stealing passwords and messages, taking screenshots and activating a device’s microphone and webcam.
For journalists, that could expose confidential sources and conversations, as well as documents stored on their devices.
Al Jazeera condemned the attacks on its staff, calling the targeting of journalists an “assault on press freedom” and demanding accountability.
Discover-Tech’s advertising operation reached networks worldwide.
Citizen Lab found that its advertisements directed millions of devices to Candiru-related servers, potentially allowing large-scale tracking and reconnaissance.
That does not mean millions of devices were infected. Profiling a device, selecting it for an attack and successfully installing spyware are different stages.
Citizen Lab found Discover-Tech advertisements reaching devices on government-operated networks in 24 countries, including Italy, Denmark, Norway, Australia, Russia, Mexico and Israel, as well as the US territory of American Samoa.
The ads also appeared on popular websites and apps, including those of news organizations such as the BBC and The New York Times, language-learning platform Duolingo and weather website AccuWeather.
Separately, advertising security firm Confiant found signs of the ads appearing on networks associated with the US Defense Department, the International Atomic Energy Agency and the International Criminal Court.
These findings show the advertising operation's reach, but do not establish that users on those networks were selected for spyware attacks or successfully infected.
Citizen Lab describes the online advertising ecosystem as “ripe for abuse.”
Much of online advertising depends on a vast, interconnected system involving real-time bidding, advertising identifiers, third-party scripts, audience targeting and automated decision-making.
This system enables precise targeting, while advertisements themselves allow outside companies to run code inside websites and applications.
Discover-Tech used both capabilities, according to the investigation.
Its selective delivery also made the activity harder to detect.
Advertising platform Eskimi told Citizen Lab that the advertisements loaded different code depending on the viewer, including their device, IP address and location, helping them evade automated checks.
Citizen Lab also said Discover-Tech appeared on “certified” or “approved” vendor lists maintained by Google and advertising industry association IAB Europe between 2020 and 2026.
It also used major advertising platforms and networks, including Google, Yandex, Vungle, Eskimi and Comcast-owned Beeswax.
According to Citizen Lab, this gave Discover-Tech access to the infrastructure normally used to distribute legitimate online advertising.
The company could therefore appear to be another advertising technology provider while operating infrastructure that researchers say was also used to facilitate spyware attacks.
After Citizen Lab disclosed its findings to several advertising companies and industry organizations, Google and IAB Europe removed Discover-Tech from their relevant vendor registries, according to the report.
Google also terminated Discover-Tech's access to its advertising exchange platforms. Beeswax removed the company from its ad-buying platform, while Vungle paused its access pending a review. Eskimi blocked Discover-Tech's accounts and domains.
Avoiding suspicious links and attachments remains important, but it offers little protection against an attack that begins when an advertisement loads.
“The moment (the ad) is rendered, their device can be hacked, so there's really no defense against this, short of not using a smartphone or (not) connecting to the internet,” Ron Deibert, Citizen Lab's director, told Canadian broadcaster CBC.
The findings also expose risks beyond spyware infection.
Citizen Lab identified another actor, which it calls Dark Cartographer, that used Discover-Tech infrastructure and vulnerabilities in mobile carrier systems to link advertising identifiers with telephone numbers.
That activity could enable the mass deanonymization of internet users, creating another means of identifying and tracking individuals. Citizen Lab said it would detail the operation in a separate report.
The researchers called for stronger regulatory scrutiny of advertising companies and recommended that organizations block targeted advertisements at their network gateways.
Deibert described the findings as a "worst-nightmare scenario," bringing together targeted advertising and mercenary spyware, which he called "two poorly regulated and highly abused industries."
“It's a recipe for disaster,” he said. “It's global espionage that we've uncovered on a massive scale.”
news_share_descriptionsubscription_contact
contact_the_ombudsman
is_there_an_error_in_this_story
