Ads Alone Infected 45 Al Jazeera Devices With Spyware, Citizen Lab Finds

What the AdFection campaign actually did

The infection started with an ordinary ad impression — a banner for earbuds, in the researchers' example — and ended with a full infostealer running on the target's machine.

Journalists at Al Jazeera noticed their devices behaving oddly in 2024 and brought them to Citizen Lab, the Canadian security research group at the University of Toronto. What the researchers found was a delivery chain nobody had documented before: a malicious ad that installed spyware the moment it was served, with no click, no download prompt and no user interaction of any kind.

Once in place, the malware was comprehensive. According to the findings, it harvested files, documents, browser cookies and bookmarks, and saved credentials. It logged keystrokes, grabbed screenshots while people worked, and could switch on the microphone and camera. Email and instant messages across multiple platforms were pulled out and sent back to whoever was running the operation.

Citizen Lab calls the campaign AdFection. Al Jazeera published its own account alongside the research.

Candiru, Discover-Tech and the ad-tech middle layer

The researchers did not identify who ordered the surveillance. They did identify the companies that built and delivered the tool.

The spyware itself is attributed to Candiru, a mercenary surveillance vendor that has since rebranded as Integrity Labs. The US Commerce Department blacklisted Candiru in November 2021 for supplying spyware to governments that used it against officials, journalists and activists. Citizen Lab notes the company was removed from that list in late July 2026.

The delivery came through Discover-Tech, an Israeli ad-tech firm that runs MyDSP, a demand-side platform buying ad inventory through automated exchanges. Citizen Lab's conclusion is blunt: the company "appears to be a front for large-scale ad espionage abuse," and serving as that bridge looks like its primary purpose rather than a side effect.

The scale is the part that should worry anyone outside journalism. Citizen Lab analysed roughly four billion ad-bidding records and found Discover-Tech ads on more than 120,000 websites and 70,000 mobile apps in the second quarter of 2026 alone. The Register, citing ad-security firm Confiant, reported that some of those ads surfaced on networks used by the Pentagon, the UN's International Atomic Energy Agency and the International Criminal Court.

How many people were hit — and who else?

At least 45 Al Jazeera devices were compromised across 2024 and 2025. The honest answer for everyone else is that nobody knows.

That gap is the story. A spyware tool that costs "several million dollars" per the researchers is not going to be sprayed at random, so the targeting was almost certainly selective. But the delivery mechanism was not: it rode on the same programmatic pipes that fill ordinary web pages and apps. If the buyers could pick targets inside that pipe, so could anyone else who acquired the same capability.

The Register's reporting on Confiant's data suggests the ad inventory reached networks that no commercial advertiser should be able to touch. Whether that reflects deliberate targeting or simply the reach of a large ad exchange is exactly the question investigators are still working through.

Why ad-delivered spyware is harder to defend against

Most malware advice assumes a human decision — a link, an attachment, a fake installer. AdFection removes that moment entirely.

Zero-click attacks are not new. They have been documented against phones through messaging apps, where a crafted message triggers a bug before the recipient sees anything. What is new here is using the ad auction itself as the delivery vehicle. That matters because ad slots are one of the few things every organisation loads from third parties it does not control.

For defenders, the practical implications are uncomfortable. Blocking ads at the network level is no longer just a productivity or privacy choice; it removes an entire attack surface that security teams cannot inspect. Keeping browsers and operating systems patched matters more than ever, since the exploit has to land somewhere. And for newsrooms, NGOs and government offices, the standard threat model — assume someone will eventually click the wrong thing — needs a companion: assume some things arrive without anyone clicking at all.

Citizen Lab has a track record of documenting commercial spyware abuses, and its reports have previously led to sanctions and vendor blacklistings. Whether this one produces the same result will depend on how regulators read the Discover-Tech evidence. The ad-tracking problem is not new either — researchers have already shown how Discover-Tech ads tracked users across 120,000 sites, and phishing campaigns like the fake calendar invite surge that hit 40,000 firms show how quickly a trusted channel turns hostile.

What it means for you

Nothing here suggests ordinary consumers were targeted, and there is no evidence of a mass infection among the general public. But the delivery route — programmatic ad exchanges — is the same one used on mainstream websites and apps in the US, UK and EU. Ad blockers and browser-level tracking protection are the most direct mitigation available to readers today.

For organisations in regulated sectors, the EU's NIS2 rules and the UK's cyber governance requirements already push towards third-party risk management. Ad tech has generally sat outside that scope. This campaign is a reasonable argument for pulling it in.

The uncomfortable part of AdFection is not that spyware exists or that journalists get targeted — both are old news. It is that the delivery method was hiding in plain sight inside the ad auction, and it took a newsroom noticing strange behaviour on its own laptops to surface it. The investigation now moves to regulators, and to whether Discover-Tech's role is treated as an ad-tech failure or something considerably more serious.