Citizen Lab says it has documented the first zero-click spyware attack delivered through online ads, and the targets included journalists at Al Jazeera.
In 2024, some Al Jazeera staff noticed their devices acting strangely and contacted Citizen Lab, a Canadian cybersecurity research group. Its researchers confirmed that at least 45 Al Jazeera devices were compromised in 2024 and 2025. The campaign, which they call "AdFection", needed no click. An ad was served, and an infostealer (malware that harvests data) ran. It took files, cookies, saved credentials, keystrokes, screenshots and messages, and it could switch on the microphone and camera.
Two Israeli companies sit in the chain. Candiru, a mercenary spyware vendor that sells to government customers, built the infostealer and the delivery mechanism. The researchers said the tool cost "several million dollars" but did not say who bought it. Candiru is now known as Integrity Labs after a rebranding and reported acquisition. The US Commerce Department blacklisted it in November 2021 for supplying spyware to foreign governments that targeted journalists, activists and officials, yet it appears to have been delisted in late July 2026.
The ads moved through Discover-Tech, which runs MyDSP, a platform that buys ad space on automated exchanges. Citizen Lab wrote that the company "appears to be a front for large-scale ad espionage abuse". Press reports say it was listed as an approved vendor with Google and IAB Europe from 2020. The researchers analyzed about 4 billion ad-bidding records and found its ads on more than 70,000 mobile apps and 120,000 websites in Q2 2026. Data from the ad security firm Confiant also put some of its ads on networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
Zero-click spyware has generally been tied to bugs in messaging apps. Ads change the shape of the problem. Choosing who sees an ad is what ad exchanges sell, so the machinery that picks an audience can also pick a victim. Telling people not to click offers no protection here, and the vetting that should have caught a front company apparently held for years.
The open question is the buyer. Nobody has said who wanted Al Jazeera's journalists watched, or why Candiru left the blacklist when it did.