Zero-click attacks used targeted ads to deliver Candiru spyware
Citizen Lab says Candiru spyware hit Al Jazeera devices through zero-click malicious ads called AdFection.
Citizen Lab reported that Israeli firm Discover-Tech used its Controlium platform to buy mainstream ad placements that delivered Candiru spyware to Al Jazeera devices without a click. JavaScript in the ads contacted a NOAS server, which sent further code only to selected targets; logs linked at least 45 devices from 2024–2025 to Candiru infrastructure. Researchers recovered a Windows DLL they attribute to Candiru, whose DevilsTongue malware can steal files, credentials, and messages. The operation placed 3.77 billion bids and won 442 million auctions from March to June 2026; Google and other advertising companies later blocked related accounts and domains.