Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports. As part of the operation, dubbedAdFection, ads purchased by Israeli company Discover-Tech were used to de-anonymize, fingerprint, and infect users, and also allow threat actors to track millions of devices. As part of the online advertising ecosystem, companies bid at billions of daily Real-Time Bidding (RTB) auctions hosted on ad exchanges for a chance to serve an ad to a user. Ad exchanges collect extensive device and user data that enables tracking, and ads may contain code that runs in the user’s application or browser, typically for tracking users, impressions, and clicks. However, ads may also contain malicious code potentially leading to malware infections and, courtesy of the various identifiers used within the ecosystem, could be used to target specific individuals with spyware, Citizen Lab says. Discover-Tech, a seemingly legitimate advertising company, is likely the front for a large campaign involving spyware infection and espionage, serving as a bridge between ad vendors and mercenary spyware vendors. Its Controlium platform enables the de-anonymization of millions of users, device fingerprinting, and zero-click hacking when an ad is displayed on the victim’s device. While the company appears to work with multiple mercenary partners, Citizen Lab has confirmed its use to profile users and infect them on behalf ofCandiru, an Israel-based spyware vendor. Many of Discover-Tech’s ads contain a script that automatically connects to its infrastructure, submits an advertising ID for the user, and executes JavaScript code served based on a combination of IP addresses and identifiers. Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in AdFection attacks leading to Candiru’s spyware. Citizen Lab says it identified a Discover-Tech server that exposed four billion ad bid records, revealing that Discover-Tech’s ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide. Citizen Lab, which has extensively detailed Discover-Tech’s Controlium platform, Candiru’s AdFection attacks, and Discover-Tech’s ad deployment mechanism, also analyzed Discover-Tech’s interaction with other surveillance threat actors. One of these, Dark Cartographer, is “building databases linking users’ mobile advertising identifiers to their phone numbers” by exploiting vulnerabilities across various mobile carriers, mass-deanonymizing internet users, Citizen Lab says. In early October, Google and IAB Europe removed the company from their ad vendor registries, Google blocked Discover-Tech’s access to its ad exchange platforms, and Beeswax and Eskimi took similar measures. “Given the current threat posed by Discover-Tech’s AdFection vectors, and the evidence of wide-scale targeting, we judge that the most feasible protection is for defenders to block targeted ads at the gateway. This defensive recommendation holds until the industry has shown that it is reliably able to block all AdFection-style vectors,” Citizen Lab notes. Related:WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order Related:Hacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in Warfare Related:‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors Related:New ‘ZeroDayRAT’ Spyware Kit Enables Total Compromise of iOS, Android Devices Ionut Arghire is an international correspondent for SecurityWeek. UK Legal Aid Agency Hack Scope Widens After Forensic Review CikaBika Bot RAT Uses Discord for C&C CenterPoint Energy Data Breach Impacts 1 Million Texans Cisco Warns of Exploited Secure Email Gateway Vulnerability Harmonic Security Raises $50 Million for Workforce AI Protection US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks F5, Juniper Networks Patch Critical Vulnerabilities Microsoft Patches Two Dozen RCE Flaws in Office Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis Context Is King in the Fight Against Modern Cyberattacks AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access. Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Randy Resnick has joined IGEL as Field CTO. Darktrace has named Adam Towns as CFOO, Mike McGuinness as CRO, and Beth Shea as CCO. Acronis has appointed Gerald Caron as CISO. Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor) As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb) - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin) Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael) Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.(Sravish Sridhar) FlipboardRedditWhatsappWhatsappEmail