Citizen Lab, Al Jazeera detail ad-delivered spyware campaign
Researchers say the AdFection infostealer reached devices through Discover-Tech's MyDSP ad platform and hit at least 45 Al Jazeera devices in 2024 and 2025.
Citizen Lab and Al Jazeera published findings on October 17, 2026, on a zero-click spyware campaign they call "AdFection", which infected journalists' devices through online ads delivered via Discover-Tech's ad infrastructure. According to techradar.com, Citizen Lab described it as the first known case of zero-click mercenary spyware distributed through online advertising.
The infostealer harvested files, documents, cookies, bookmarks and credentials, captured keystrokes and screenshots, and used the microphone and camera to record victims. Researchers said the tool cost several million dollars. Citizen Lab attributed the infostealer and its delivery mechanism to the mercenary spyware company Candiru, and said the ads were allegedly served through the MyDSP platform operated by the Israeli ad-tech company Discover-Tech.
At least 45 Al Jazeera devices were compromised this way in 2024 and 2025, according to the findings. Citizen Lab said it analysed roughly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites in the second quarter of 2026 alone. Confiant data reported by The Register indicated that some Discover-Tech ads also appeared in networks used by the Pentagon, the IAEA and the International Criminal Court.
Earlier actions against Candiru
The US Department of Commerce blacklisted Candiru in early November 2021 for supplying spyware to foreign governments that targeted officials, journalists and activists, and delisted the company in late July 2026. It now operates as Integrity Labs. According to The Register, Discover-Tech had been listed with Google and IAB Europe as an approved vendor since 2020.
Quick answers
What is AdFection?
It is the name Citizen Lab and Al Jazeera gave to a zero-click spyware campaign that infected devices through online ads, using an infostealer built by Candiru and ads allegedly served through Discover-Tech's MyDSP platform.
Who was targeted?
At least 45 Al Jazeera devices were compromised in 2024 and 2025, according to the findings.
What did the infostealer collect?
Files, documents, cookies, bookmarks and credentials, plus keystrokes and screenshots, and audio and video from the microphone and camera.