One ad was enough: Candiru spyware targeted Al Jazeera with zero clicks
On October 15, Citizen Lab published the first technical proof of spyware delivered through targeted ads, with no click needed. The vendor was approved in Europe: why blocking ads is now a security measure.
Automated publication. This article was written by artificial intelligence, then checked by a second AI model that verifies the facts against primary sources. It was published without prior human review.
Translated from French by AI. The original French article is the reference version.
No booby-trapped attachment, no suspicious link. According to the University of Toronto's Citizen Lab, an ad simply appearing on screen was enough to start the infection. On October 15, the lab published a report titled “AdFection.” It describes what it presents as the first public technical confirmation of a “zero-click” mercenary spyware attack delivered through targeted advertising.
The named victim is the media group Al Jazeera. According to the network logs it provided to researchers, at least 45 of its devices were targeted in 2024 and 2025. The spyware is attributed to Candiru, an Israeli vendor that says it sells only to governments.
How can a banner infect a computer?
At the center of the operation is Discover-Tech, an Israeli company that Citizen Lab describes as a “bridge” between spyware vendors and the advertising ecosystem. It bought ad placements on mainstream ad networks and exchanges, like any advertiser. Its ads contained a script that, when displayed, queried a Discover-Tech server and sent it the device's IP address and advertising identifiers.
That server did the sorting. A targeted device received additional code; the others got nothing at all. According to Citizen Lab, this filtering also kept the malicious code hidden from the ad networks. Al Jazeera's logs then show traffic to Candiru validation servers, followed by command servers. On a compromised Windows machine, the researchers recovered a library (DLL) that they attribute to Candiru with high confidence.
The scale of the distribution raises questions. According to BleepingComputer, which analyzed the report, ads carrying Discover-Tech's script appeared in 75,373 Android and iOS apps and on 120,768 websites. These are not infections: the filtering aimed at only a handful of targets. The report does not, in fact, confirm any infection on mobile, since the sample analyzed was a Windows DLL.
A vendor approved for European consent banners
The European angle is the most troubling. Since July 2, 2020, Discover-Tech had been on IAB Europe's list of approved vendors, the one used by GDPR-related consent banners. It was removed from the list on October 8, 2026. According to Citizen Lab, its ads were also displayed on the networks of European Union institutions, Nordic countries, Czechia and Italy.
After being alerted, Google, IAB Europe, Beeswax and Eskimi cut off Discover-Tech's access. Vungle (Liftoff) suspended it pending a review. Discover-Tech, Candiru and Xandr, Microsoft's ad exchange, had not responded within the deadline given by the researchers. Xandr has already been fined in Norway in another case, as we reported in the Grindr case. Citizen Lab is asking regulators to investigate Discover-Tech and Candiru.
What should a company or government agency do?
There is no vulnerability to patch here: the way in is the ad itself. Citizen Lab's recommendations therefore go in that direction:
- Block ads at the gateway (proxy, DNS filtering) and on work computers and mobile devices. The report notes that the NSA and CISA already recommended ad blockers in 2018 and 2020.
- Disable advertising identifiers on the organization's mobile devices, or at least reset them regularly. According to the report, this directly blocks Discover-Tech's current method.
- Prefer browsers that limit tracking, and monitor traffic related to ad display.
- For exposed individuals (journalists, elected officials, activists): a trusted blocking extension and a privacy-respecting browser.
One question remains that the report does not settle: how many other “approved” vendors are doing the same job? Citizen Lab believes Discover-Tech works with several spyware vendors. What happens next now depends on the data protection authorities.
Method: article written by artificial intelligence from public sources, facts verified by a second, independent AI model, published automatically without prior human review, under the editorial responsibility of Frédéric LENQUETTE. Spotted an error? Let us know.
Share this article
