Citizen Lab's investigation describes a spyware delivery system that could turn an ordinary-looking digital ad into a route for a zero-click attack. The researchers concluded that 45 devices belonging to Al Jazeera were targeted through ads in 2024 and 2025.
A zero-click attack does not require the victim to open a file or tap a malicious link. On a vulnerable device, visiting a website or opening an app that displayed the targeted ad could be enough to begin the attack, according to Citizen Lab and its research partner, the ad-security company Confiant.
Citizen Lab named the campaign “AdFection” and said it was the first detailed public technical demonstration of sophisticated mercenary spyware infections delivered through targeted advertising.
How the ad delivery path worked
Digital advertising systems make rapid decisions about which ads to show a user. Those decisions can draw on advertising identifiers, IP addresses, browser details and other device information. Citizen Lab says the advertising company Discover-Tech used that infrastructure to identify and profile potential targets.
The researchers said selected devices could be routed from domains associated with Discover-Tech to infrastructure linked to Candiru, an Israeli spyware developer that now operates as Integrity Labs. In the Al Jazeera case, Citizen Lab analyzed network logs that the news organization shared with the researchers. The logs helped the researchers reconstruct how the attack unfolded.
The findings do not identify which government, customer or other operator selected Al Jazeera devices for targeting. They also do not mean that every Discover-Tech ad carried spyware. The report separates the advertising infrastructure, the Candiru-attributed spyware and the still-unknown entity behind a particular targeting decision.
