{"id":100687,"date":"2026-10-17T07:14:19","date_gmt":"2026-10-17T11:14:19","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=100687"},"modified":"2026-10-17T07:14:19","modified_gmt":"2026-10-17T11:14:19","slug":"discover-tech-candiru-zero-click-spyware-100687","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/discover-tech-candiru-zero-click-spyware-100687\/","title":{"rendered":"Discover-Tech Delivers Candiru Zero-Click Spyware to Al Jazeera"},"content":{"rendered":"

The use of the online advertising ecosystem as a delivery mechanism for state-grade spyware has taken a chilling leap forward. A new investigation reveals that journalists at Al Jazeera<\/a> were infected with Candiru’s zero-click spyware through targeted advertisements, marking one of the most brazen weaponizations of digital marketing infrastructure yet documented. The operation, named AdFection by the Citizen Lab<\/a>, was orchestrated by an Israeli company called Discover-Tech, which served as both a legitimate ad broker and a covert conduit for espionage.<\/p>\n

How Targeted Ads Became a Spyware Delivery System<\/h2>\n

The attack chain exploits the very mechanisms that make digital advertising profitable: Real-Time Bidding (RTB) auctions, device fingerprinting, and the vast amounts of user data traded between ad exchanges. In a typical RTB auction, thousands of companies bid for the opportunity to show an ad to a specific user, with each bid based on data about that user’s device, location, browsing history, and advertising identifiers. Discover-Tech turned this routine process into a surveillance pipeline.<\/p>\n

When Discover-Tech won an RTB auction, the ad served to the target’s device contained hidden JavaScript code. That code automatically connected to Discover-Tech’s infrastructure, submitted the device’s advertising ID, and executed further instructions based on a combination of IP addresses and other identifiers. Critically, this setup allowed for zero-click exploitation: the victim did not need to tap a link, open a file, or perform any action beyond simply viewing the ad. The infection took place silently in the background.<\/p>\n

This technique, termed an AdFection vector, enables both de-anonymization and device compromise within a single ad impression. Citizen Lab identified that Discover-Tech’s ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide, giving the threat actors an exceptionally broad attack surface.<\/p>\n

What Is Zero-Click Spyware and How Does It Work?<\/h3>\n

Zero-click spyware is malware that can install itself on a target device without any user interaction. Traditional spyware often requires the victim to click a malicious link or open an infected attachment. Zero-click exploits, by contrast, leverage vulnerabilities in the device’s operating system, messaging apps, or, in this case, the advertising ecosystem. The ad itself contains code that triggers the exploit chain the moment it is rendered, granting the attacker remote access to the device’s microphone, camera, messages, and location data. This makes zero-click attacks exceptionally difficult to detect because no user error is involved.<\/p>\n

Discover-Tech: A Legitimate Front with a Hidden Agenda<\/h2>\n

Discover-Tech presented itself as a legitimate advertising technology company. Its core product, the Controlium platform, was marketed as a tool for ad verification and audience targeting. In practice, Citizen Lab found that Controlium was engineered to perform mass de-anonymization of internet users, building detailed profiles linking advertising IDs to real-world identities and device fingerprints.<\/p>\n

The scale of the operation is staggering. The researchers discovered a Discover-Tech server that inadvertently exposed four billion ad bid records, each containing detailed device and user data. This leak not only confirmed the breadth of Discover-Tech’s reach but also revealed the company’s interactions with multiple mercenary spyware vendors. While Discover-Tech appears to have worked with several such entities, Citizen Lab confirmed its specific use to profile and infect users on behalf of Candiru, another Israel-based spyware vendor known for selling Windows and mobile exploits to governments.<\/p>\n

Between 2024 and 2025, at least 45 devices within Al Jazeera’s network were targeted in AdFection attacks that successfully delivered Candiru’s spyware. The news organization, which is one of the most prominent in the Middle East, has been a frequent target of state-sponsored hackers, but this marks the first confirmed case of spyware being injected through the ad supply chain on such a scale.<\/p>\n

The Broader Ecosystem: Dark Cartographer and Mass Deanonymization<\/h2>\n

Beyond the direct attacks on Al Jazeera, Citizen Lab identified another threat actor leveraging Discover-Tech’s infrastructure: a group dubbed Dark Cartographer. This operation is “building databases linking users’ mobile advertising identifiers to their phone numbers” by exploiting vulnerabilities across various mobile carriers. The goal is mass deanonymization of internet users on a global scale.<\/p>\n

This parallel effort underscores a disturbing trend: the advertising technology ecosystem has become a vector not just for surveillance but for building permanent identity databases that can be used by multiple government and private-sector clients. Once a device’s advertising ID is linked to a phone number, email address, or real name, that mapping can be sold or shared among spyware vendors, enabling more precise targeting and tracking.<\/p>\n

Industry Response: Google and IAB Europe Take Action<\/h2>\n

In early October, following the Citizen Lab’s disclosures, Google and IAB Europe removed Discover-Tech from their ad vendor registries. Google blocked Discover-Tech’s access to its ad exchange platforms, and other ad-tech firms including Beeswax and Eskimi took similar measures. These actions effectively cut Discover-Tech off from the major programmatic advertising channels, but the broader vulnerability remains.<\/p>\n

The speed of the industry response was notable, but it also highlights a systemic weakness. The RTB ecosystem operates on trust and self-certification: ad vendors attest that their code is safe, but no comprehensive, independent vetting occurs before an ad is served to millions of devices. Discover-Tech was a seemingly ordinary participant until the evidence of its malicious use became undeniable.<\/p>\n

Defending Against AdFection Vectors<\/h2>\n

Citizen Lab has offered a stark recommendation: “Given the current threat posed by Discover-Tech’s AdFection vectors, and the evidence of wide-scale targeting, we judge that the most feasible protection is for defenders to block targeted ads at the gateway. This defensive recommendation holds until the industry has shown that it is reliably able to block all AdFection-style vectors.”<\/p>\n

For organizations in high-risk sectors \u2014 journalism, human rights<\/a>, government, and corporate security \u2014 this means deploying network-level ad blocking and content filtering that prevents programmatic ads from loading on devices used for sensitive work. While this may break the functionality of many websites, the trade-off between convenience and security has become increasingly stark. Individual users on mobile devices may consider using ad-blocking browsers or VPNs that strip tracking scripts, but these measures are not foolproof against zero-click exploits that target operating system vulnerabilities.<\/p>\n

The AdFection case also raises urgent questions for the advertising industry. Current RTB protocols allow any registered bidder to serve code to end users with minimal oversight. The fact that a company could weaponize this system against a major news network for over a year before being stopped suggests that the existing safeguards are inadequate. Industry bodies and regulators may need to introduce mandatory code audits, real-time threat monitoring, and strict liability for ad-serving platforms that inadvertently deliver spyware.<\/p>\n

The Candiru spyware case is a watershed moment. It demonstrates that the line between legitimate digital advertising and cyber-espionage is not as clear as once assumed. As long as the ad-tech ecosystem enables granular tracking and code execution on end-user devices, it will remain an attractive target for mercenary spyware vendors and state-backed attackers. The response from technology companies and policymakers in the coming months will determine whether this becomes a new norm or a catalyst for fundamental reform.<\/p>\n","protected":false},"excerpt":{"rendered":"

The use of the online advertising ecosystem as a delivery mechanism for state-grade spyware has taken a chilling leap forward. A new investigation reveals that journalists at Al Jazeera were infected with Candiru’s zero-click spyware through targeted advertisements, marking one of the most brazen weaponizations of digital marketing infrastructure yet documented. The operation, named AdFection […]<\/p>\n","protected":false},"author":7,"featured_media":100690,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/100687.png","fifu_image_alt":"Discover-Tech Delivers Candiru Zero-Click Spyware to Al Jazeera","footnotes":""},"categories":[40668],"tags":[],"class_list":["post-100687","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/100687.png","fifu_image_alt":"Discover-Tech Delivers Candiru Zero-Click Spyware to Al Jazeera","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/100687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=100687"}],"version-history":[{"count":1,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/100687\/revisions"}],"predecessor-version":[{"id":100688,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/100687\/revisions\/100688"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/100690"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=100687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=100687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=100687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}