The finding

The attack did not need a click

Citizen Lab documented infections of devices at Al Jazeera with Candiru mercenary spyware delivered through targeted online advertisements. The researchers call the technique AdFection. In their account, an intermediary, Discover-Tech, used advertising infrastructure to identify and reach selected devices. Malicious content could arrive when an ad rendered on a page or in an app, without the target deliberately opening a link.

The scale figures need care. Citizen Lab analyzed nearly four billion bidding records and found the company's ads across almost 200,000 websites and mobile apps. Millions of devices contacted related infrastructure, likely for tracking and reconnaissance. Those observations are not millions of confirmed infections. Citizen Lab describes at least 45 Al Jazeera devices targeted in 2024 and 2025 and provides technical evidence of infection in the investigated cases.

Keep four stages separate

An ad impression, device profiling, an attempted exploit and a confirmed spyware infection are different findings. Collapsing them into one number would exaggerate what the investigation proves.

Defender workflow

Protect the people most likely to be selected

  1. 1

    Identify high-risk users. Include journalists, human-rights workers, executives and others facing targeted surveillance. Review where their work devices browse, which apps render third-party ads and what telemetry can be collected lawfully.

  2. 2

    Keep devices recoverable. Prioritize timely OS and browser updates, managed configurations, separation of sensitive accounts and a clear path to preserve and escalate suspicious devices. A no-click delivery route makes user-awareness advice alone inadequate.

  3. 3

    Investigate with the right threshold. Use Citizen Lab's technical indicators as leads, not automatic proof of infection. Correlate device, network and forensic evidence with the user's risk profile and the time of suspected exposure; involve specialist mobile forensics when warranted.

Defender note

The ad supply chain belongs in the threat model

Many organisations treat advertisements as background content rather than a route to code execution or surveillance. This case shows why that assumption can fail for high-value targets. It is also a reminder to phrase outcomes precisely: Citizen Lab proved specific infections; the much wider ad footprint explains potential reach, not a count of compromised devices.