Citizen Lab reveals new spyware technique

The Citizen Lab, a research group at the University of Toronto, released a report on October 15 detailing a new method of cyberattack called AdFection. This technique involves embedding malicious code in targeted advertisements, which can infect a device simply by being displayed, without needing a user to click on a link or open a file.

Zero-click attack bypasses usual defenses

The AdFection method is classified as a zero-click attack because it does not require user interaction to execute. This means that typical precautions, such as avoiding suspicious links, do not provide protection. The Citizen Lab noted that this is the first public technical evidence that spyware of this type uses advertisements as a delivery mechanism.

Al Jazeera targeted in documented case

The report identifies a documented case where the Qatari news channel Al Jazeera was targeted between 2024 and 2025. At least 45 of its Windows devices were targeted, according to Forbes. The Citizen Lab attributes the attack to Candiru, a spyware program capable of monitoring messages, calls, and device locations.

Candiru linked to Israeli company

Candiru was previously identified by the Citizen Lab in 2021. That same year, the United States added the Israeli company behind Candiru to its commercial blacklist. The company later rebranded as Integrity Labs after being acquired by the American fund Integrity Partners in 2025.

Ad network used to deliver malware

The malicious advertisements were purchased by Discover-Tech, an Israeli advertising network founded in 2020. The company's tool, Controlium, allows clients to target devices by IP address or advertising identifiers. This enables the delivery of malicious ads that can execute code when displayed.

Real-time ad auction system exploited

Ad networks use real-time auctions to display advertisements, where an application transmits device information to buyers. The highest bidder then shows their ad. This system, designed for marketing, allows precise targeting of individual users. Discover-Tech used this mechanism to insert malicious scripts into ads.

Malicious code hidden in ad scripts

Discover-Tech's script queried its own servers to determine if a device was targeted. If so, the server returned code that directed the device to Candiru's servers, which then infected the device. The advertising networks displaying these ads were unaware of the malicious code. The Citizen Lab recovered nearly four billion auction records from Discover-Tech's servers.

Ads appeared on major platforms and institutions

Between March and June 2026, the malicious ads were displayed in 75,373 Android and iOS applications, including popular ones like MX Player, Viber, and Duolingo. They also appeared on 120,768 websites, including those belonging to NATO, the UN, the Norwegian Parliament, the Swedish armed forces, and Australian nuclear research organizations.

Ad blockers and privacy settings recommended

The Citizen Lab advises users to install ad blockers and disable advertising tracking in their phone settings. It also recommends regularly resetting the advertising identifier on devices to reduce the risk of being targeted by malicious ads.

Discover-Tech suspended from advertising networks

Following an audit, IAB Europe suspended Discover-Tech from its list of authorized vendors for collecting consent from European internet users. Similarly, Beeswax, Comcast’s advertising platform, also removed Discover-Tech. Despite this, the company had been certified by both Google and IAB Europe since 2020.

No response from involved companies

Neither Discover-Tech nor Candiru responded to requests for comment. Al Jazeera, which agreed to be named in the report, also had not responded when Forbes published its article. Wolfie Christl, one of the report's co-authors, acknowledged the difficulty of defending against such malicious advertisements.