Citizen Lab Reveals First Zero-Click Spyware Delivered via Online Ads Targeting Al Jazeera

This incident exposes critical vulnerabilities in the digital advertising ecosystem that can be exploited for surveillance.

• Citizen Lab confirmed the first public evidence of zero-click mercenary spyware delivered via targeted online ads.
• Discover-Tech, an Israeli advertising firm, facilitated the distribution of Candiru spyware to at least 45 devices at Al Jazeera.
• Real-time bidding in global ad networks was exploited to silently infect targets without user interaction.

• Mercenary spyware vendors like Candiru have historically targeted journalists and activists, raising concerns about privacy and security.
• Digital advertising relies on real-time bidding, which broadcasts device identifiers and IP data, making it a potential vector for exploitation.
• Previous reports hinted at ad networks' role in surveillance, but this investigation provides the first technical confirmation of zero-click infections.

The investigation by Citizen Lab, dubbed 'AdFection,' reveals a sophisticated operation where Discover-Tech utilized its Controlium platform to link ad auctions with spyware infrastructure. By embedding malicious JavaScript in seemingly benign ads, the firm was able to collect device identifiers and target specific users without any interaction required on their part. This method allowed for the silent installation of Candiru spyware, rebranded as Integrity Labs, on devices belonging to journalists and staff at Al Jazeera between 2024 and 2025.

The analysis of billions of bidding records uncovered that ads linked to this spyware were displayed across over 120,000 websites and 70,000 apps. The forensic evidence confirmed that 45 devices at Al Jazeera were infected, but the implications extend far beyond this single organization. The operation also exposed sensitive networks, including NATO and EU institutions, to profiling, indicating a broader threat landscape.

The systemic vulnerabilities in the digital advertising ecosystem are alarming. Real-time bidding processes, which are designed to optimize ad placements, inadvertently create opportunities for malicious actors to exploit user data. This incident underscores the need for regulatory scrutiny of the ad industry, as the current lack of oversight allows for the proliferation of such spyware delivery methods.

As the digital landscape continues to evolve, the intersection of advertising technology and cybersecurity becomes increasingly critical. The ad industry's reliance on data-driven targeting creates a double-edged sword: while it enhances marketing effectiveness, it also opens the door to invasive surveillance tactics. The findings from Citizen Lab call for immediate action from regulators and media organizations to enhance device security and audit vendor approvals.

• Journalists and media organizations: Increased risk of surveillance and compromised communications.
• Advertisers and marketers: Potential backlash and loss of consumer trust in digital advertising.
• Regulators and policymakers: Pressure to implement stricter regulations on ad networks and spyware vendors.
• General consumers: Heightened awareness of privacy risks associated with online browsing and app usage.

• Regulatory actions: Monitor for any new regulations or audits initiated by governments in response to this incident, as they could reshape the ad industry.
• Security enhancements: Look for media organizations to adopt stronger cybersecurity measures to protect their devices and data.
• Market shifts: Watch for changes in consumer behavior regarding online ads, as awareness of spyware risks may lead to reduced engagement.