Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click

Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique “AdFection”.

The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by an Israeli ad-tech firm called Discover-Tech.

zero-click spyware attacks

Online ads are sold in real-time auctions that run in under a second. Bid requests carry device IDs, IP addresses and location data, so an advertiser can target one specific person. Ads can also carry code that runs inside the app or browser showing them.

In an AdFection attack, that code fetches more JavaScript, which can in turn load a browser exploit that installs spyware.

According to research published by Citizen Lab, many Discover-Tech ads contained a script tag that called back to a “NOAS server”. The ad sent the user’s cookie ID or mobile ad ID to that server.

The server returned JavaScript only to eligible targets, based on the IP address and ad identifiers, and sent a 0-byte response to everyone else. That design kept malicious code and pointers to it away from the ad vendors.

Citizen Lab linked the 2024–2025 attacks to Candiru, now rebranded as “Integrity Labs”, with high confidence. At least 45 Al Jazeera devices were targeted.

Network logs showed the same sequence each time, where the device first contacted Discover-Tech infrastructure to mark an ad impression, then connected to a Candiru validator server to perform an initial check, and finally contacted a Candiru command-and-control (C&C) server.

Al Jazeera recovered a Windows DLL from a compromised device. It hardcodes C&C servers fearevolve[.]com and jobmarcher[.]com. It persists through a COM hijack and obfuscates strings with a 48-byte repeating XOR key. Those traits match Candiru’s 2021 chain.

Discover-Tech runs a platform called Controlium. Customers use it to pick victims by mobile ad ID, cookie ID or IP address and push “controlled ads” to them. It supports Beeswax, Eskimi and Discover-Tech’s own MyDSP.

The researchers also found weaknesses in the platform, noting that Controlium misused Auth0, so a hacker could probably forge an authentication token, and an unauthenticated /csv-download endpoint exposed login logs, allowing Citizen Lab to pull 128 days of them covering 120 usernames.

Almost four billion bidding records showed Discover-Tech ads on nearly 200,000 websites and apps over four months. The ads also pushed millions of devices to contact Candiru servers, likely for tracking and reconnaissance.

A separate actor, DARK CARTOGRAPHER, used the same infrastructure to link advertising IDs to phone numbers.

Discover-Tech appeared on “certified” vendor lists from Google and IAB Europe from 2020 to 2026. Google, IAB Europe, Beeswax and Eskimi have since cut it off, and Vungle (Liftoff) paused its access.

The report says ads are now a cybersecurity and privacy crisis and calls for regulators to investigate. Defenders should block the indicators above and monitor for ad-domain traffic followed by validator or C&C connections.

High-risk users such as journalists should keep browsers and operating systems fully patched. Ad or script blocking can also cut exposure.