AdFection: Citizen Lab and Confiant document zero-click Candiru spyware delivered through targeted online ads from the ad-tech firm Discover-Tech, with ad impressions on defence-ministry, armed-forces and NATO networks

Citizen Lab reports that in 2024 and 2025 at least 45 devices at the news network Al Jazeera were targeted in zero-click attacks that it links with high confidence to Candiru spyware delivered through ads bought by Discover-Tech, an Israeli firm that presents itself as an ad company (Citizen Lab, 2026-10-15). An ad carries a script tag that calls Discover-Tech's ad-decision server with the user's cookie or mobile advertising identifier; the server decides, apparently from the source address and the identifiers, whether the device is eligible, and returns JavaScript only if so and a zero-byte response otherwise, which keeps malicious code and pointers to it out of what ad vendors can inspect (Citizen Lab, 2026-10-15). In Al Jazeera's network logs an infected device first contacted Discover-Tech infrastructure, which indicates an ad impression, then a Candiru validator server that checks the device, and finally a Candiru command-and-control server; a Windows implant that Al Jazeera isolated from a compromised device and Citizen Lab analysed persists through COM hijacking (Citizen Lab, 2026-10-15). Confiant, working from ad-delivery telemetry from April to September 2026, describes a cloaked payload that fingerprints the device and opens an encrypted channel, and found a hand-off to Candiru-attributed infrastructure, with Belgium by far the most targeted country at 56 percent of the global hits in the period; it has not captured a full exploit chain (Confiant, 2026-10-15).

Citizen Lab's analysis of four billion Discover-Tech bidding records shows ads on almost 200,000 websites and apps in four months, including on devices in networks of defence ministries, armed forces, national cyber agencies and intergovernmental organizations such as NATO; an impression alone does not prove targeting or infection (Citizen Lab, 2026-10-15). Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi disconnected Discover-Tech after the disclosure (Citizen Lab, 2026-10-15).

Triage: ordinary ad tags also call identifier-bearing endpoints and sync user IDs; the reported discriminators are the eligibility gating, with an empty reply for ineligible devices and code only for chosen ones, and the validator-then-command-and-control sequence (Citizen Lab, 2026-10-15).