Citizen Lab ties ad network to zero-click spyware

Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware to at least 45 Al Jazeera devices, with other infections unconfirmed.

The Citizen Lab, with Confiant, disclosed a campaign it calls AdFection, saying Israeli ad firm Discover-Tech profiled devices and could deliver mercenary spyware when an advertisement loaded, sometimes without a click or a visible ad. Most outlets name the Controlium platform, while Security Affairs calls it MyDSP; TechCrunch says at least Candiru and Bindecy used it, later reports tie the Al Jazeera activity to Candiru, now Integrity Labs, and The Record says Candiru hired Discover-Tech. Sources disagree on whether at least 45 Al Jazeera devices were infected or only targeted in 2024 and 2025, and on whether they were Windows computers, phones, or journalists’ devices. From March through June 2026 the ads appeared on more than 120,000 websites and 70,000 apps; Security Affairs cited 3,770,286,576 bids and about 441,954,291 wins, while The Record says researchers reviewed four billion placement records across nearly 200,000 websites. The same ads were reported on networks tied to the U.S. Department of Defense or Pentagon, NATO, the IAEA, the ICC, the UN, European institutions, Estonia’s RIA, and other government and critical-infrastructure bodies, with infection unconfirmed beyond Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi later restricted Discover-Tech; some reports also describe Dark Cartographer linking advertising IDs to phone numbers, and Ars Technica says the flaws and final malware were not named.

• Citizen Lab and Confiant disclosed AdFection: Discover-Tech ads that can deliver mercenary spyware when an ad loads, sometimes with no click or visible ad.
• TechCrunch says Candiru and Bindecy used the platform; later outlets tie the Al Jazeera cases to Candiru, now Integrity Labs, and The Record says Candiru hired Discover-Tech.
• Sources disagree whether at least 45 Al Jazeera devices in 2024–2025 were infected or only targeted, and whether they were Windows PCs, phones, or journalists’ devices.
• Most outlets name Controlium; Security Affairs calls the platform MyDSP and cites 3,770,286,576 bids and about 441,954,291 wins from March–June 2026.
• Ads appeared on more than 120,000 websites and 70,000 apps; The Record says four billion placement records across nearly 200,000 websites.
• Impressions also reached DoD/Pentagon, NATO, IAEA, ICC, UN, European bodies, Estonia’s RIA, and other government or infrastructure networks, with infection unconfirmed outside Al Jazeera.
• Google, IAB Europe, Beeswax, Vungle, and Eskimi later restricted Discover-Tech; some reports also describe Dark Cartographer linking ad IDs to phone numbers.
• Ars Technica says the exploited flaws and final malware were not named.