An online ad was enough to deliver spyware—no click required

Security researchers say targeted advertising was used to infect devices at the Al Jazeera news agency, exposing how everyday online ads can become a delivery system for surveillance.

You don’t have to click a suspicious link to become a spyware target. Sometimes, simply loading an ad can be enough. Citizen Lab says it has documented that scenario at Al Jazeera, offering what it describes as the first public technical confirmation of mercenary spyware infections delivered through targeted ads.

Key takeaways

• Researchers say targeted ads delivered Candiru spyware to devices at Al Jazeera
• The attack technique, dubbed AdFection, requires no click from the victim
• Millions of devices contacted surveillance infrastructure, but that doesn’t mean that all were infected
• Google and other advertising companies restricted Discover-Tech’s access following the investigation

How an ad becomes an infection route

In its Oct. 15 report, Citizen Lab identifies Israeli company Discover-Tech as a bridge between advertising platforms and commercial spyware vendors.

Its Controlium platform lets customers select targets using advertising identifiers, browser identifiers or IP addresses. An ad shown to a selected device can then trigger delivery of malicious code, without the person clicking anything.

Citizen Lab says at least 45 devices at Al Jazeera were targeted in 2024 and 2025. Researchers linked the attacks, with high confidence, to Candiru spyware, based on network evidence and a malicious Windows file recovered from a compromised device. The figure represents devices targeted, not a confirmed infection count.

The same system that finds customers can find surveillance targets

Targeted advertising relies on rapid auctions that help advertisers reach particular audiences. Information shared through that process can reveal details about devices, browsing activity and location.

According to Citizen Lab, Discover-Tech used this infrastructure to identify users and selectively deliver attack code. Keeping the exploit separate from the initial ad helped conceal its purpose from the platforms distributing it.

A parallel investigation by advertising security company Confiant shows how elaborate that selection process can be.

Confiant examined that can collect device and network characteristics, monitor certain interactions, and receive instructions through encrypted communications. Such checks can help operators distinguish an intended victim from an automated security scanner.

The researchers also describe a mechanism for delivering additional code, including browser exploits. They caution that browser restrictions limit what some of the observed functions can access inside an advertisement.

The implication is unsettling: an ad’s appearance tells you little about the code running behind it.

Broad exposure does not mean everyone was infected

Citizen Lab found that Discover-Tech’s ads directed millions of devices toward profiling and infection infrastructure. Ads appeared across familiar websites and everyday apps, including news, weather and dating services.

The researchers also identified ad impressions on government, media and critical infrastructure networks.

Following the investigation, Google and IAB Europe removed Discover-Tech from their vendor lists. Google and Beeswax also terminated its access to their advertising systems.

What you can do to reduce exposure

“Don’t click suspicious ads” remains useful advice, but it can’t address an attack triggered by an ad loading.

Practical steps include:

• Use reputable ad and tracker blocking tools. Check the publisher and permissions before installing a new web browser or browser extension.
• Keep browsers, apps and operating systems updated. Enable automatic updates so that available security fixes reach your devices promptly.
• Review advertising privacy settings. Limit personalized advertising and unnecessary tracking permissions.
• Seek expert help if your work makes you a surveillance target. Journalists, activists and others handling sensitive information should involve their security team when compromise is suspected.

As we note in this post on how spyware can end up on your device, spyware is one the most dangerous types of malware out there, not just because of its ability to pilfer sensitive data, but also because it can infect devices without any input from the user. It’s designed to enable covert collection of information about a user's activities without their knowledge or consent.

State-sponsored hackers use spyware to target high-profile targets, like dissidents, political activists, and journalists – typically to gather data involving geopolitical rivalries.

Be mindful of the ad-attack avenue signaled by Citizen Lab and always keep your devices up to date with the latest security updates issued by your vendor. Consider using an independent security solution as well, not just to combat spyware, but to protect yourself against the wider palette of threats out there.

Bitdefender includes an ad-blocking and anti-tracking feature with Bitdefender Premium VPN.

On topic:

Apple patches zero-day behind ‘extremely sophisticated’ iPhone attacks

Update your iPhone and Mac! Apple patches image flaw with spyware potential

WhatsApp Patches Zero-Click Spyware Attack Vector on Android