Citizen Lab Links Targeted Ad Campaign to Zero-Click Candiru Spyware Attacks

Summary

Citizen Lab linked targeted ads to Candiru spyware attacks against at least 45 Al Jazeera devices in 2024–2025, describing how ad code selected targets and tracing network activity to spyware infrastructure.

Key points

The ads could deliver spyware when rendered, without a user click; Citizen Lab called the technique AdFection.
Discover-Tech’s Controlium platform reportedly used ad identifiers and IP addresses to select targets, with JavaScript contacting a NOAS server.
Al Jazeera provided evidence of attacks targeting at least 45 devices between 2024 and 2025.
Researchers traced network activity from Discover-Tech infrastructure to Candiru validation servers and spyware command-and-control servers.
Citizen Lab recovered a DLL from a compromised Windows system and attributed it with high confidence to Candiru based on infrastructure and code overlaps.
Between March and June 2026, the ad operation reportedly placed 3.77 billion bids and won 442 million auctions; researchers said these figures do not represent infections.
After Citizen Lab’s reports, Google and other advertising companies removed offending accounts and blocked access to domains.

Article Details

Attack Vectors: Targeted online advertisements embedded with JavaScript delivered Candiru spyware in a zero-click attack; rendering the ad was sufficient, with no user click required.
The JavaScript contacted Discover-Tech's NOAS (or getAd) server, which used parameters such as IP addresses and ad identifiers to select eligible target devices and deliver additional code.
Researchers reported that the observed attack sequence progressed from Discover-Tech infrastructure to Candiru validation servers and then to spyware command-and-control servers.
Defensive Notes: Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked access to domains after receiving Citizen Lab's reports.