Citizen Lab 'AdFection': Candiru spyware infected Al Jazeera devices through targeted online ads with no click needed; Israeli ad firm Discover-Tech's ads also reached Australian grid, power, university and nuclear-research networks (ANSTO, Australian Synchrotron)
The Citizen Lab (University of Toronto) published report 195 on 15 October 2026, which it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertising. It names the technique AdFection. Devices at the international news network Al Jazeera were infected with spyware from Candiru, the Israeli vendor now rebranded as Integrity Labs, through ads bought by Discover-Tech, an Israeli company that presents itself as an ordinary ad firm. Each ad carried a small script that sent the device's advertising ID and IP address to a Discover-Tech server as soon as the ad rendered, sometimes out of sight. Selected devices were then sent attack code; others got nothing, so the ad networks had nothing harmful to detect. Al Jazeera's network logs showed the same sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then command-and-control. Per The Hacker News, at least 45 Al Jazeera devices were targeted in 2024 and 2025, and a recovered Windows sample matches Candiru tooling Citizen Lab analysed in 2021. The browser or app exploit used for the first break-in was not recovered, and Citizen Lab has not named the government customer. Discover-Tech's bidding records (about four billion bids, March to June 2026) show ads carrying the attacker script on 75,373 Android and iOS apps and 120,768 websites; Confiant, which investigated alongside Citizen Lab, puts its traffic at roughly 10 million ads a day. Impressions appeared on networks of NATO, the UN, EU institutions, defence and government bodies in dozens of countries, and critical infrastructure. Australian angle: the report describes a 'substantial cluster' of impressions in Australia, including government and private-sector networks in critical infrastructure such as grid and power companies, and university and research networks including the Australian Nuclear Science and Technology Organisation (ANSTO) and the Australian Synchrotron. Citizen Lab stresses that an impression alone does not confirm targeting or infection, but says these networks warrant urgent investigation. Google and IAB Europe had listed Discover-Tech as a certified or approved ad vendor since 2020. After the findings were shared they removed it in early October (IAB Europe on 8 October), Google cut its ad-exchange access, Beeswax removed it, Vungle (Liftoff) paused it and Eskimi blocked its accounts. Primary: Citizen Lab report; technical indicators: Confiant; wire: The Hacker News. Update 16 Oct (iTnews): ANSTO said it is aware of the reports including the Australian Synchrotron reference, is following standard response processes, and has not identified any impact to its facilities, systems or information from the techniques described. The ads also appeared on networks of three Australian media organisations (unnamed in the Citizen Lab report). Further detail (iTnews, 16 Oct): Confiant, which published its own report alongside Citizen Lab, said the ads it linked to Candiru were a tiny fraction of Discover-Tech's activity, and Australia was not among the nine countries where it saw devices handed over to Candiru's systems. Citizen Lab's data shows Discover-Tech bid 3.77 billion times between March and June 2026 and won about 442 million auctions.
- Product
- Online advertising supply chain (Discover-Tech ad platform; ads in about 75,000 mobile apps and 120,000 websites) used to deliver Candiru / Integrity Labs spyware
- Versions
- n/a — campaign (Al Jazeera targeting 2024–2025; bidding data March–June 2026); delivery exploit not recovered
- Exploited in Australia?
- unknown
- Patch to
- Government, critical-infrastructure, research and media organisations: block ads and ad tracking at the gateway and on managed devices (Citizen Lab calls ad-blocking a cybersecurity best practice); block the published Discover-Tech and Candiru indicators (for example mtrtb[.]com, plus Confiant's list) and search DNS and proxy logs for the sequence Discover-Tech ad server, then Candiru screening server, then C2. Limit or reset advertising IDs on corporate phones, and keep browsers, OSes and apps fully patched because the delivery exploit is unknown. Essential Eight user application hardening already requires that web browsers do not process web advertisements from the internet, from Maturity Level One, so treat ad blocking as a baseline control rather than an extra.
Primary: Citizen Lab — Exposing AdFection: How Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware (Report 195, 15 Oct 2026) · Vendor: Confiant — ADINT: weaponized ad tech for zero-click spyware and mass identity vacuuming (15 Oct 2026; indicators) · iTnews — Australian gov, media networks reached by Israeli firm's spy ads; ANSTO says no impact identified (16 Oct 2026)