Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal
Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click code hidden in online advertisements.
Citizen Lab published what it calls the first public technical proof of zero-click mercenary spyware delivered through targeted ads, a method it named AdFection. At least 45 Al Jazeera devices were targeted in 2024 and 2025 with spyware linked to Israeli vendor Candiru, now Integrity Labs. Discover-Tech's Controlium platform matched advertising IDs, cookies, or IP addresses and could return JavaScript that started infection after an ad loaded. Investigators tied a recovered Windows DLL to Candiru; it used COM hijacking and a 48-byte repeating XOR routine. After notification, Google and several ad platforms removed or suspended Discover-Tech.