Spyware Campaign Turns Digital Advertising into a Weapon Against Journalists and Millions of Users

In a chilling intersection of digital advertising and state-sponsored espionage, an investigation by the University of Toronto’s Citizen Lab has revealed that the invasive ecosystem of online advertising is being weaponized to deploy high-end spyware. The campaign, dubbed "AdFection," has been linked to the Israel-based spyware vendor Candiru and a shadowy advertising entity known as Discover-Tech. According to the report, this mechanism has been used to conduct zero-click attacks against employees of the international news network Al Jazeera, turning the mundane act of browsing the web into a potential security catastrophe.

The discovery highlights a profound vulnerability in the global advertising infrastructure. Every day, billions of Real-Time Bidding (RTB) auctions take place across the internet. When a user visits a website or opens an application, an automated, lightning-fast auction occurs to determine which ad will be served to that specific device. While this process is ostensibly designed to match products with consumers, Citizen Lab’s findings illustrate how this same architecture has been repurposed by threat actors to de-anonymize, fingerprint, and eventually compromise the devices of unsuspecting targets on a massive scale.

The Weaponization of Ad Tech

At the center of this operation is Discover-Tech, a company that presented itself as a legitimate player in the advertising space but which, according to researchers, served as a vital bridge between the legitimate ad-tech ecosystem and mercenary spyware vendors. The company operated a platform known as "Controlium," which provided the infrastructure necessary to track, identify, and infect users when an ad was served to their browser or mobile application.

The mechanics of the attack are particularly concerning due to their "zero-click" nature. In traditional phishing, a user must be tricked into clicking a malicious link or downloading a suspicious attachment. In an AdFection attack, the mere display of a targeted advertisement is sufficient to trigger the exploit. The advertisements themselves contain malicious scripts that automatically connect to Discover-Tech’s infrastructure. Once a connection is established, the script submits the user’s advertising ID and executes JavaScript code tailored to the specific device’s IP address and other unique identifiers.

This process allows the threat actors to bypass traditional user defenses. By the time the ad is rendered on the screen, the device may have already been fingerprinted or, in more severe cases, compromised with spyware. Citizen Lab’s investigation confirmed that between 2024 and 2025, at least 45 devices belonging to Al Jazeera staff were targeted through these means, leading to successful infections by Candiru’s spyware.

A Global Dragnet

The scale of Discover-Tech’s operations appears to be vast. Citizen Lab researchers identified a misconfigured Discover-Tech server that inadvertently exposed roughly four billion ad bid records. This data dump offered a rare glimpse into the reach of the surveillance operation, showing that the company’s advertisements had been served across nearly 200,000 unique websites and a multitude of mobile applications on both Android and iOS platforms worldwide.

The exposure of these records underscores the inherent risks of the modern advertising ecosystem. Because ad exchanges collect extensive device and user data to facilitate tracking and ad placement, the barrier to entry for malicious actors is dangerously low. By injecting malicious code into the ad-stream, entities like Discover-Tech can hide in plain sight, masquerading as standard advertising vendors while facilitating espionage.

Citizen Lab’s research into Discover-Tech also exposed connections to other surveillance-focused threat actors. One notable entity identified in the report is "Dark Cartographer," a group that has been observed building sophisticated databases that link mobile advertising identifiers to actual phone numbers. By exploiting vulnerabilities across various mobile carriers, this group is reportedly engaged in the mass de-anonymization of internet users, effectively stripping away the digital privacy of millions of people.

The Industry Response and Future Risks

The revelations regarding AdFection have prompted a swift, albeit overdue, response from major players in the advertising industry. In early October, both Google and IAB Europe removed Discover-Tech from their respective ad vendor registries. Google took the additional step of blocking the company’s access to its ad exchange platforms entirely. Other industry participants, including Beeswax and Eskimi, followed suit, severing ties with the company in an attempt to mitigate the threat.

Despite these countermeasures, experts remain cautious about the long-term implications. The AdFection model is not necessarily dependent on a single company; it is an inherent risk of the way the programmatic advertising market is currently structured. The ability to purchase ad space at scale, combined with the ability to inject custom, sophisticated scripts into those ads, provides a powerful tool for any actor with the necessary resources and lack of moral scruples.

Citizen Lab has been direct in its assessment of the threat. The group noted that given the nature of the AdFection vector and the clear evidence of large-scale targeting, traditional security methods are insufficient. The researchers recommend that defenders—including network administrators and organizations—should consider blocking targeted ads at the network gateway as a proactive measure.

"This defensive recommendation holds until the industry has shown that it is reliably able to block all AdFection-style vectors," Citizen Lab stated in its findings. This advice highlights a difficult reality for many organizations: in an age where digital surveillance is becoming increasingly integrated into the fabric of the web, the only way to remain safe may be to opt out of the very advertising ecosystems that power the modern internet.

A Broader Pattern of Digital Espionage

The Candiru-linked campaign is part of a growing trend of state-sponsored or mercenary-led digital warfare. Recent history is replete with examples of high-end spyware being used to compromise the privacy of journalists, activists, and political dissidents. From the controversies surrounding the NSO Group and its Pegasus software to the emergence of newer "ZeroDayRAT" kits, the global market for offensive cyber capabilities is thriving.

The incident at Al Jazeera serves as a stark reminder that the digital battlefield is not limited to government networks or military installations. It encompasses the entirety of the digital advertising space, an industry that is notoriously opaque and difficult to police. The ease with which an advertising platform can be weaponized to deliver sophisticated spyware suggests that the digital threat landscape is shifting toward more passive, less detectable forms of intrusion.

As organizations grapple with the fallout of the AdFection campaign, the focus is shifting toward the responsibility of ad-tech providers. For years, the industry has prioritized the efficiency and reach of ad auctions over the security of the users being tracked. The revelation that these auctions have been turned into a pipeline for state-sponsored spyware raises significant questions about accountability and the necessity of stricter oversight within the digital advertising sector.

For the time being, the security community continues to monitor for signs of similar campaigns. As the tools for surveillance become more accessible and the infrastructure of the web remains inherently permissive, the risk of "zero-click" infections via advertising will likely remain a persistent threat to privacy and security. The case of Discover-Tech and Candiru is not merely a story of a single bad actor; it is a signal of a structural weakness that requires a fundamental reassessment of how digital advertising is conducted, verified, and secured in an era of persistent, pervasive cyber espionage.