Security researchers have documented a mercenary-spyware delivery system that could infect selected devices when an online advertisement appeared, without requiring the victim to click or download anything. Citizen Lab named the method AdFection and linked the final spyware to Candiru, an Israeli surveillance vendor now operating as Integrity Labs.

The investigation found that at least 45 devices associated with international news organization Al Jazeera were targeted during 2024 and 2025. Network evidence showed affected systems contacting infrastructure belonging to advertising company Discover-Tech after an ad impression, followed by Candiru-linked validation and command-and-control servers.

Advertising data became a targeting system

Modern online advertisements are active software components rather than simple images. They can run JavaScript, load resources from multiple companies and participate in real-time auctions that decide which ad to display in fractions of a second. Those auctions may expose attributes such as IP address, approximate location, browser details, mobile advertising identifiers and tracking cookies.

Citizen Lab says Discover-Tech’s Controlium platform allowed customers to identify people through those signals. When an advertisement loaded, embedded code contacted the company’s infrastructure. The server then determined whether the viewer matched a selected target and, if so, returned additional JavaScript that could begin the exploitation chain.

This design has two advantages for a surveillance operator. It reaches targets across many unrelated websites and apps, and it can reserve the malicious response for a very small set of devices. Ordinary visitors see a normal advertisement, leaving researchers and advertising platforms with few chances to capture the exploit.

From an ad impression to spyware

Researchers reconstructed a sequence in which a target first communicated with Discover-Tech infrastructure, then reached a Candiru validation system used to check the device and finally connected to a spyware command server. The lack of a required click makes the chain especially dangerous for journalists, activists and other people exposed to commercial surveillance.

The report describes this as the first public technical demonstration of zero-click mercenary spyware delivered through targeted advertising. It does not mean every advertisement from the identified infrastructure infected its viewer. Instead, a broad advertising presence supplied the opportunity to locate particular devices and deliver a different response only when targeting criteria matched.

A large ecosystem surrounding narrow attacks

Citizen Lab reviewed roughly four billion advertising-bid records spanning four months in 2026. Discover-Tech advertisements appeared across nearly 200,000 distinct websites and Android or iOS applications in dozens of countries. Millions of devices were silently directed toward infrastructure associated with Candiru, according to the analysis.

Those huge numbers describe reach and redirection, not confirmed compromise. The report confirmed a much smaller set of targeted Al Jazeera devices. This distinction is important: spyware campaigns often use mass infrastructure to create a global selection mechanism while reserving expensive exploits for specific individuals.

The research also places Discover-Tech between the commercial advertising market and several surveillance vendors. The company presents itself as an advertising business, but its targeting capabilities allegedly helped spyware operators transform routine ad telemetry into a path toward device compromise.

Defensive options are limited but useful

• Keep operating systems, browsers and applications fully updated to remove exploitable flaws.
• Use high-security modes such as Apple’s Lockdown Mode when individual risk warrants it.
• Block unnecessary advertising and tracking content through managed network controls.
• Monitor for connections to known spyware infrastructure and unexpected redirect chains.
• Separate sensitive work from general browsing on high-risk accounts and devices.

Individuals cannot fully defend themselves against a carefully selected zero-click exploit, especially when a legitimate website unknowingly carries the delivery mechanism. Advertising platforms and app publishers therefore have a central role: they must scrutinize intermediaries, limit data shared during bidding and preserve enough telemetry to investigate selective malicious responses.

AdFection shows how technologies designed to identify an ideal advertising audience can also identify an ideal surveillance target. The discovery expands the spyware threat model beyond malicious links and messages to the background infrastructure of everyday web browsing, where simply being served an ad may be enough to initiate an attack.

Source: Cyber Security News.