Controlium’s AdFection Zero-Click Ads Deliver Candiru Spyware to Al Jazeera

Researchers at The Citizen Lab have released technical evidence detailing a spyware distribution campaign that exploits the online advertising ecosystem. Dubbed "AdFection," the attacks allow operators to install mercenary spyware on devices simply by rendering targeted ads, requiring no clicks or user interaction. According to WIRED Security, this represents the first publicly available technical confirmation of such sophisticated spyware being delivered via digital ads in the wild.

The risk

The mechanism bypasses traditional user-error vectors by automating the infection process. When a targeted device renders a specific advertisement, the system performs deanonymization and fingerprinting to verify the target. If the device matches the criteria, it receives malicious JavaScript code; otherwise, it receives nothing, maintaining stealth. This zero-click approach means victims see no obvious signs of compromise, and may not even notice the ad itself, as noted by senior researcher Bill Marczak.

Who is exposed

The campaign specifically targeted devices belonging to Al Jazeera Media Network. Citizen Lab concluded that at least 45 devices were targeted between 2024 and 2025. According to The Record, parallel investigations by Confiant found evidence that these malicious ads were also rendered on networks belonging to the U.S. Department of Defense, Estonia’s Information System Authority, the International Atomic Energy Agency, and the International Criminal Court. Citizen Lab stated that ads appeared on national-security-sensitive networks, including NATO infrastructure.

Cost and compliance

The advertising firm Discover-Tech allegedly collaborated with Candiru, an Israeli spyware developer blacklisted by the U.S. Commerce Department in 2021. Major platforms, including Google, have blocked Discover-Tech following the research disclosure. The Controlium platform served millions of ads used for monitoring and reconnaissance, directing devices to Candiru servers. This activity exposes organizations to significant surveillance risks and potential regulatory scrutiny regarding data privacy and supply chain integrity within their digital advertising frameworks.

What to watch

Security teams should monitor for unauthorized outbound connections to known spyware command-and-control infrastructure, particularly from devices rendering ads. Verify that ad-blocking measures are effective across all corporate and personal devices used for sensitive work. Scrutinize network logs for fingerprinting requests or unusual JavaScript loads triggered by ad networks, as these may indicate reconnaissance preceding an infection attempt.

Signals worth monitoring

Teams usually detect zero-click ad campaigns by analyzing DNS logs for queries to suspicious validation servers immediately after ad impressions. Check whether endpoints exhibit unusual memory usage or network traffic spikes correlated with ad rendering events. Look for beaconing behavior to domains associated with mercenary spyware vendors. Initial containment often involves isolating affected devices and blocking traffic to known adversary infrastructure, while preserving forensic artifacts for further investigation.

Background: Supply chain attacks

Protect your organization by verifying software signatures, isolating third-party access, and monitoring dependencies. This checklist provides specific actions to reduce risk from compromised vendors, ensuring your security posture remains intact even when external partners fail.

Read the full guide: Supply Chain Attack Prevention Checklist for Secure Operations

What to do and how to stay safe: AdFection

• Deploy strict ad-blocking policies on all corporate devices to minimize exposure to malicious ad content.
• Monitor network egress for connections to known spyware command-and-control servers and IP addresses.
• Restrict JavaScript execution in browsers where possible to reduce the attack surface for web-based exploits.
• Audit third-party advertising vendors and block traffic to platforms linked to surveillance capabilities once the vendor provides an update.

Step-by-step guide: Ransomware Backups: Definition, Purpose, and Recovery Strategy

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AdFection?

AdFection is a technique where mercenary spyware is distributed via targeted online ads, infecting devices without any user interaction or clicks.

Which organizations were targeted?

At least 45 Al Jazeera devices were targeted, alongside networks for the U.S. Department of Defense, NATO, and other international agencies.

Is there a patch for this vulnerability?

No fix has been confirmed yet, as the attack exploits the ad ecosystem rather than a single software flaw requiring a traditional patch.