By Evan Lee Salim 
In a chilling intersection of global digital advertising and state-sponsored espionage, researchers at Citizen Lab have uncovered a sophisticated spyware campaign dubbed "AdFection." The operation, which utilized the massive, automated ecosystem of real-time bidding (RTB) in online advertising, successfully delivered zero-click exploits to devices belonging to employees at the international news network Al Jazeera. By hijacking the mechanisms used to serve targeted advertisements, the operators were able to de-anonymize, fingerprint, and ultimately compromise the mobile devices of specific individuals, raising urgent questions about the safety of journalists and the integrity of the modern web advertising infrastructure.
The investigation, published by the University of Toronto’s Citizen Lab, points to an Israeli-based advertising entity known as Discover-Tech as the primary architect behind this malicious pipeline. While Discover-Tech presented itself as a legitimate participant in the digital advertising space, Citizen Lab’s analysis suggests it served as a covert bridge between mainstream ad vendors and mercenary spyware purveyors—most notably the Israel-based firm Candiru.
The Mechanism of Malicious Advertising
To understand the scale and precision of the AdFection campaign, one must first look at the mechanics of the internet’s backbone. Every day, billions of Real-Time Bidding (RTB) auctions take place in milliseconds across ad exchanges. When a user visits a website or opens an application, an automated auction occurs to determine which advertisement will appear on their screen. Advertisers bid for this space, and in the process, they receive vast amounts of telemetry data—including device identifiers, location data, and user browsing history—to ensure the ad is "relevant."
Typically, the code embedded within these ads is designed for legitimate tracking, such as measuring impressions or click-through rates. However, the AdFection operation exploited the trust inherent in this ecosystem. Discover-Tech allegedly utilized its "Controlium" platform to turn these legitimate-looking ad spaces into conduits for malicious activity.
According to Citizen Lab, when an ad served by Discover-Tech was displayed on a victim’s device, a hidden script would automatically connect to the company’s infrastructure. This script would submit the user’s unique advertising ID and then execute specific JavaScript code tailored to the device’s IP address and technical fingerprint. This process allowed for a "zero-click" attack, meaning the user did not need to click a link or download a file to be infected; the mere loading of the ad on a webpage or within an application was sufficient to initiate the compromise.
Al Jazeera Targeted in Large-Scale Espionage
The impact of this campaign was not theoretical. Citizen Lab confirmed that between 2024 and 2025, at least 45 devices belonging to Al Jazeera staff were targeted through AdFection, resulting in the successful deployment of Candiru’s potent spyware. This represents a targeted effort to compromise a news organization known for its high-profile investigative reporting and global reach.
The audacity of the operation is further illustrated by the sheer volume of data involved. Researchers identified a Discover-Tech server that had been left exposed, revealing a staggering four billion ad bid records. This data dump offered a window into the scope of the operation, showing that Discover-Tech’s malicious ads had been deployed across nearly 200,000 unique websites and a multitude of mobile applications for both Android and iOS. This broad reach suggests that the campaign was not limited to a few isolated incidents but was a systemic abuse of the advertising industry’s reach to facilitate global surveillance.
Discover-Tech and the Surveillance Ecosystem
The investigation suggests that Discover-Tech was far from an isolated rogue actor; rather, it was a central node in a broader, darker surveillance ecosystem. The company’s Controlium platform provided the infrastructure necessary for mass de-anonymization, allowing threat actors to track millions of devices.
Citizen Lab’s analysis also identified links between Discover-Tech and other surveillance entities, including a group known as "Dark Cartographer." This group has been observed building expansive databases that link mobile advertising identifiers to actual phone numbers. By exploiting vulnerabilities across mobile carriers, Dark Cartographer has effectively managed to mass-deanonymize internet users, providing a dangerous level of granularity to the surveillance capabilities of their clients.
By serving as a middleman, Discover-Tech enabled mercenary spyware vendors to reach targets they might otherwise never have been able to infect. It bridged the gap between the chaotic, opaque world of programmatic advertising and the highly targeted, precision-based world of state-sponsored espionage.
Industry Response and Future Defenses
As the evidence of AdFection’s reach mounted, the advertising industry began to take punitive measures. In early October, major players moved to sever ties with the entity. Google, which operates one of the world’s largest ad exchanges, removed Discover-Tech from its vendor registries and blocked its access to its platforms. Similarly, other industry entities, including IAB Europe, Beeswax, and Eskimi, implemented measures to restrict the company’s ability to participate in ad auctions.
Despite these removals, the fundamental vulnerability that AdFection exploited remains. The programmatic advertising ecosystem is inherently complex and opaque, making it difficult for users—and even for publishers—to verify exactly what code is being executed by the ads appearing on their screens.
Citizen Lab has been vocal about the limitations of current defenses. Given the sophistication and the speed of the AdFection vectors, the researchers have concluded that the most effective, albeit blunt, protection is for network defenders to block targeted ads at the gateway. This recommendation, while potentially disruptive to the digital economy, is presented as the only viable path until the advertising industry can prove that it has developed robust, reliable methods to filter out these malicious vectors.
The case of Al Jazeera serves as a stark reminder of how digital infrastructure, built for commerce and communication, can be subverted for the purposes of state surveillance. The AdFection campaign highlights a growing, existential threat to the digital security of journalists, activists, and ordinary citizens alike. As long as the ad-tech industry continues to prioritize real-time bidding and deep-user tracking without sufficient oversight, the pipeline for spyware will likely remain open, ready to be exploited by those who view the internet not as a public square, but as a map for their next target.
The struggle to secure the digital ecosystem is far from over. As spyware firms become increasingly clever in how they deliver their payloads, and as the lines between legitimate advertising and cyber-espionage continue to blur, the burden of protection is falling on those who manage the gateways to the internet. For now, the "AdFection" operation remains a haunting example of how the very ads that follow us across the web can become the silent, invisible instruments of our own compromise.
Asep Darmawan 
Nana Wu 
Ali Ikhwan