Candiru: online ads were enough to install spyware on devices

According to a report by Citizen Lab, relayed on 16 October 2026 by Bleeping Computer, the Candiru spyware was delivered to devices belonging to Al Jazeera Media Network through targeted advertisements. The attack requires no click: it is enough for the ad to be displayed on the device. The researchers call this technique AdFection, and they see it as the first public technical confirmation of mercenary spyware delivered through targeted advertising.

This information rests on a single source, the Citizen Lab report as relayed by Bleeping Computer. We have not cross-checked it with a second independent source, so the points below are those described in that report.

A precedent documented in 2025

At the end of 2025, Amnesty International documented a similar method: ads that infected targets with the Predator spyware, again with no click required. This mechanism, named Aladdin, emerged from marketing files and documents from the surveillance company Intellexa, which were leaked and then studied by researchers. AdFection differs on one point: it was observed in real attacks, and it is attributed to the Israeli company Discover-Tech.

One ad, then a filter

According to Citizen Lab, Discover-Tech bought advertising space from mainstream ad networks and auction platforms. Its ads embedded JavaScript that contacted a server belonging to the company, called NOAS or getAd, as soon as the ad was displayed. Based on parameters such as the IP address or advertising identifiers, this server assessed whether the device could receive additional code. Selected targets received it; other devices received nothing, which makes the operation hard to detect.

The company’s platform, named Controlium, let its customers target specific devices with malicious code, or profile them, deanonymize them and fingerprint them. Network logs provided by Al Jazeera show a chain running from Discover-Tech’s infrastructure to Candiru validation servers, and then to the spyware’s command servers.

Candiru, and targets beyond a newsroom

Candiru is an Israeli company that sells surveillance tools, officially only to governments. It developed DevilsTongue, Windows malware capable of stealing files, credentials and messages. According to earlier reports, its tools have been deployed through zero-day flaws in Windows and Chrome against journalists, activists and political officials.

Al Jazeera gave Citizen Lab information about attacks that targeted at least 45 devices between 2024 and 2025. On a compromised Windows system, the researchers recovered a DLL library that they attribute to Candiru with high confidence, based on overlaps in infrastructure and code with samples captured earlier.

A campaign on a large scale

Between March and June 2026, the advertising operation placed 3.77 billion bids and won 442 million, according to Citizen Lab. Ads judged to carry the attacker’s script tags appeared in 75,373 Android and iOS apps and on 120,768 websites. These figures do not count infections: Citizen Lab estimates that hundreds of thousands to millions of users were directed to these domains through Discover-Tech’s ads.

After these reports, Google, IAB Europe, Beeswax, Eskimi and Vungle removed the accounts concerned and blocked access to some domains. In this case, not clicking does not protect you: it was enough for the ad to appear on your screen. The source article describes no countermeasure within the reach of the user.