Citizen Lab finds zero-click spyware delivered through online ads, with Al Jazeera devices infected

TLDR

• Citizen Lab reports the first technical demonstration of zero-click spyware delivered through targeted online advertisements, which it calls "AdFection".¹³
• Citizen Lab says with high confidence that Al Jazeera devices were infected with Candiru spyware.¹²
• The exploit code arrives separately, so ads conceal their purpose from the platforms that deliver them.¹²³

Citizen Lab's report says the real-time bidding system that powers targeted advertising can be weaponised at scale to profile millions of users and then silently infect chosen targets.¹ Its centrepiece is Discover-Tech, which it describes as a bridge between the advertising ecosystem and mercenary spyware firms, and which operates Controlium, a platform that lets those firms profile and deanonymise users and send ads that lead to exploitation of individual devices.¹ Citizen Lab says Controlium's users include Candiru and that the platform is also linked to Bindecy and to a firm called Intelos.¹

According to Citizen Lab, a user shown one of the ads has their ad identifier and IP address passed to Discover-Tech's servers, and if they are selected the device is sent malicious JavaScript that exploits it. Because the visible ads do not themselves contain exploit code, the hidden purpose is concealed from the platforms that deliver them.¹ TechCrunch reports the researchers could rebuild Controlium's control panel from source code left exposed on its login pages, and that exposed login records included accounts belonging to at least two Candiru employees and some from Bindecy.²

Citizen Lab said it is not clear which governments were behind the attacks.² Exposed bidding records show Discover-Tech's ads appeared across tens of thousands of apps and websites between March and June 2026, including on devices used by militaries, governments, critical infrastructure and national cyber agencies, though it is unclear whether those ads led to any infection.² TechCrunch also reports Confiant found potentially malicious ads shown on the networks of the International Atomic Energy Agency and the International Criminal Court.² Al Jazeera and Discover-Tech did not respond to TechCrunch's requests for comment.² Researchers advise people who may be targeted to disable ad tracking, block ads and regularly reset mobile ad IDs.²³

Why it matters: Citizen Lab says this is the first concrete technical evidence of an ad auction being used to deliver a spyware infection, a route that had been suspected before. Because the exploit code arrives separately from the visible ad, the ads conceal their purpose from the platforms that deliver them, and the researchers' advice to people at risk is to disable ad tracking, block ads and reset mobile ad IDs.¹²³