Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click
Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click malicious online ads called AdFection.
Citizen Lab reported the first public case of zero-click mercenary spyware delivered through targeted online ads, a technique it calls AdFection. With high confidence it linked 2024-2025 attacks on at least 45 Al Jazeera devices to Candiru, now rebranded Integrity Labs, using ads bought by Israeli firm Discover-Tech. Malicious ad code returned exploit JavaScript only to selected identifiers, then devices contacted Candiru validator and command-and-control servers including fearevolve[.]com and jobmarcher[.]com. A recovered Windows DLL persisted via COM hijack; Google and ad platforms have since cut Discover-Tech off.
- Citizen Lab calls the zero-click ad delivery technique AdFection.
- At least 45 Al Jazeera devices were targeted with Candiru spyware in 2024-2025.
- Discover-Tech's Controlium selected victims by ad ID, cookie, or IP.
- A recovered Windows DLL used COM hijacking and a 48-byte XOR key.
- Google, IAB Europe, Beeswax, Eskimi, and Vungle later cut off Discover-Tech.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | fearevolve.com | ows DLL from a compromised device. It hardcodes C&C servers fearevolve[.]com and jobmarcher[.]com. It persists through a COM hijack an |
| domain | jobmarcher.com | mised device. It hardcodes C&C servers fearevolve[.]com and jobmarcher[.]com. It persists through a COM hijack and obfuscates strings |
Full article516 words · extracted from gbhackers.com · click to collapse
Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique “AdFection”.
The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by an Israeli ad-tech firm called Discover-Tech.
zero-click spyware attacks
Online ads are sold in real-time auctions that run in under a second. Bid requests carry device IDs, IP addresses and location data, so an advertiser can target one specific person. Ads can also carry code that runs inside the app or browser showing them.
In an AdFection attack, that code fetches more JavaScript, which can in turn load a browser exploit that installs spyware.
According to research published by Citizen Lab, many Discover-Tech ads contained a script tag that called back to a “NOAS server”. The ad sent the user’s cookie ID or mobile ad ID to that server.
The server returned JavaScript only to eligible targets, based on the IP address and ad identifiers, and sent a 0-byte response to everyone else. That design kept malicious code and pointers to it away from the ad vendors.
Citizen Lab linked the 2024–2025 attacks to Candiru, now rebranded as “Integrity Labs”, with high confidence. At least 45 Al Jazeera devices were targeted.
Network logs showed the same sequence each time, where the device first contacted Discover-Tech infrastructure to mark an ad impression, then connected to a Candiru validator server to perform an initial check, and finally contacted a Candiru command-and-control (C&C) server.
Al Jazeera recovered a Windows DLL from a compromised device. It hardcodes C&C servers fearevolve[.]com and jobmarcher[.]com. It persists through a COM hijack and obfuscates strings with a 48-byte repeating XOR key. Those traits match Candiru’s 2021 chain.
Discover-Tech runs a platform called Controlium. Customers use it to pick victims by mobile ad ID, cookie ID or IP address and push “controlled ads” to them. It supports Beeswax, Eskimi and Discover-Tech’s own MyDSP.
The researchers also found weaknesses in the platform, noting that Controlium misused Auth0, so a hacker could probably forge an authentication token, and an unauthenticated /csv-download endpoint exposed login logs, allowing Citizen Lab to pull 128 days of them covering 120 usernames.
Almost four billion bidding records showed Discover-Tech ads on nearly 200,000 websites and apps over four months. The ads also pushed millions of devices to contact Candiru servers, likely for tracking and reconnaissance.
A separate actor, DARK CARTOGRAPHER, used the same infrastructure to link advertising IDs to phone numbers.
Discover-Tech appeared on “certified” vendor lists from Google and IAB Europe from 2020 to 2026. Google, IAB Europe, Beeswax and Eskimi have since cut it off, and Vungle (Liftoff) paused its access.
The report says ads are now a cybersecurity and privacy crisis and calls for regulators to investigate. Defenders should block the indicators above and monitor for ad-domain traffic followed by validator or C&C connections.
High-risk users such as journalists should keep browsers and operating systems fully patched. Ad or script blocking can also cut exposure.