Researchers have uncovered a spyware campaign that used online advertising infrastructure to target devices belonging to Al Jazeera personnel, highlighting growing concerns around the misuse of digital advertising systems for cyberattacks. The investigation by Citizen Lab at the University of Toronto revealed a campaign named “AdFection”, where researchers documented how targeted advertisements could potentially be used as a pathway for delivering sophisticated spyware without requiring users to interact with the malicious content.
According to Citizen Lab’s findings, the campaign represents a rare example of zero-click spyware activity connected to online advertising. Zero-click attacks are considered highly advanced because they can compromise devices without requiring victims to click links, download files or take any visible action. Researchers said that during 2024 and 2025, 45 devices belonging to Al Jazeera were targeted through attacks delivered via advertisements. The investigation found that targeted advertisements were issued by Discover-Tech, an Israeli-founded marketing firm, and that affected devices showed connections with infrastructure associated with spyware developer Candiru, based on Citizen Lab’s analysis. The researchers explained that modern online advertising systems allow advertisers to deliver personalized content to specific users through complex processes such as real-time bidding. While these systems are designed for targeted advertising, Citizen Lab said the same infrastructure can create opportunities for misuse if security controls and vendor monitoring are insufficient. The researchers stated that Discover-Tech operated an advertising platform called Controlium, which they said could enable activities including device identification and automated infection attempts when advertisements were displayed.
Bill Marczak, a senior researcher at Citizen Lab, said the AdFection campaign demonstrates how mercenary spyware operators can use advertising systems to target specific individuals while remaining invisible to users. He noted that victims may not notice unusual activity on their devices, and in some cases may not even see the advertisement connected to the attack. Wolfie Christl, another senior Citizen Lab researcher, described the possibility of devices being infected through websites or applications displaying advertisements as a serious security concern. The investigation also highlighted the wider scale of online advertising risks. Citizen Lab researchers said advertising records connected to Discover-Tech showed that advertisements containing attacker-related scripts appeared across more than 70,000 mobile applications and over 120,000 websites between March and June. Researchers estimated that millions of devices were directed toward infrastructure linked to Candiru, although they clarified that not every advertisement associated with the company was necessarily used for spyware distribution.
Following collaboration with Citizen Lab and cybersecurity firm Confiant, Google removed Discover-Tech from its advertising platforms after identifying policy violations connected to spyware activity. Google also introduced Safe Browsing warnings to help protect users accessing websites linked to the group. The Interactive Advertising Bureau’s European branch also confirmed that Discover-Tech had been suspended from its global vendor list following a review of its policies. Cybersecurity researchers said the incident highlights the need for stronger oversight across the digital advertising ecosystem. While zero-click spyware campaigns remain uncommon and technically complex, experts warned that the widespread use of advertising technologies creates potential opportunities for abuse. The findings underline the importance of improving security practices, vendor verification processes and monitoring systems to reduce risks associated with online advertising infrastructure.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
