Agree & Join LinkedIn
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Create your free account or sign in to continue your search
or
New to LinkedIn? Join now
By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.
Online advertisements have been used to deliver mercenary spyware without requiring victims to click a link, download a file or approve an installation, according to an investigation by the University of Toronto’s Citizen Lab.
The researchers call the technique AdFection and say they uncovered infections at Al Jazeera involving spyware attributed to Candiru, an Israeli surveillance technology company. Their findings identify advertising firm Discover-Tech as an intermediary connecting commercial advertising infrastructure with spyware operations. The investigation, published on October 15, provides what Citizen Lab describes as the first public technical confirmation of targeted advertising being used to deliver zero-click mercenary spyware.
The findings raise a difficult question for organisations responsible for protecting sensitive communications: how should they defend employees when an attack can begin through content loaded automatically during ordinary browsing?
According to Citizen Lab’s investigation, Discover-Tech’s Controlium platform supported device identification, profiling and targeted infection. An analysis of roughly four billion bidding records showed its advertisements appearing across almost 200,000 websites and mobile applications over four months.
Millions of devices contacted infrastructure associated with Candiru, apparently for reconnaissance and tracking. That figure does not represent millions of confirmed spyware infections: advertising exposure, profiling, attempted exploitation and successful compromise are different stages.
45 Al Jazeera devices were targeted during 2024 and 2025. It also reported that Google blocked Discover-Tech from its advertising platforms, IAB Europe suspended its vendor listing, and Beeswax removed it from its platform.
A companion technical investigation by advertising security company Confiant explains how apparently ordinary advertising content can conceal a more sophisticated operation.
Confiant traced an advertisement to a sequence of scripts that gathered information about the device and established an encrypted channel for further instructions. The framework could assess browser and device characteristics before receiving additional code. Such selective delivery allows an operator to examine a visitor before deciding whether to send a more sensitive payload.
The researchers also found data collection involving publisher cookies across more than 1,000 domains. What could be accessed depended on how the advertisement was embedded and the browser protections surrounding it.
There is an important limit to Confiant’s findings: the company said it had not captured a complete exploit chain in the wild. Its analysis documented the targeting and delivery framework, while attribution to Candiru relied on Citizen Lab’s investigation. Running JavaScript inside an advertisement is not, by itself, equivalent to taking control of a phone; successful compromise requires crossing the device’s security boundaries.
For defenders, the practical implication is that inspecting a banner’s appearance or destination link provides only a partial view. The significant behaviour may occur through background requests before anyone interacts with the advertisement.
Advertising-based spyware delivery had already emerged in research into another surveillance vendor, Intellexa.
In December 2025, Amnesty International’s Security Lab published an investigation into leaked Intellexa materials describing a delivery system called Aladdin. Internal documents presented it as a way to trigger infection by displaying a malicious advertisement on a target’s phone.
The material described targeting based on a public IP address. Amnesty assessed that Aladdin was supported in active Predator deployments during 2024 and that advertising-based delivery continued to be developed in 2025.
Amnesty also explained the operational incentive. A malicious link sent directly to a person can be recognised, reported and shared with investigators. An advertisement that loads automatically can remove that opportunity for the target to identify the approach.
Those findings concern Intellexa and Predator, rather than proving their involvement in the newly reported Candiru campaign. Together, however, the investigations show why advertising delivery has attracted interest across the commercial surveillance industry.
Candiru has appeared in earlier investigations involving browser exploitation and attacks against civil society.
In July 2021, Microsoft disclosed research into an offensive technology supplier it tracked as SOURGUM, which Citizen Lab identified as Candiru. Microsoft said the associated malware had targeted more than 100 people, including journalists, politicians, academics, embassy workers, human rights activists and dissidents.
The investigation identified malware called DevilsTongue and two Windows privilege-escalation vulnerabilities, CVE-2021-31979 and CVE-2021-33771, fixed in July 2021. Microsoft described browser and operating-system exploits being combined to install malware, with browser exploits apparently delivered through single-use links sent over messaging applications.
Those historical vulnerabilities should not be mistaken for the vulnerabilities involved in AdFection. Their relevance is architectural: spyware delivery can involve several stages, moving from initial browser access to higher privileges and then surveillance software. Changing how the initial content reaches a device can make the attack less visible to its owner.
Another precursor appeared in ESET’s November 2021 investigation into strategic website compromises.
ESET documented attacks affecting websites associated with media organisations, government bodies and other institutions, particularly in the Middle East. The websites served as stepping stones to selected visitors rather than being the attackers’ ultimate objective.
Injected scripts collected information about visitors’ browsers, operating systems and locations. ESET identified links with Candiru and assessed that particular visitors were likely to receive browser exploits.
The comparison illustrates the significance of advertising delivery. A traditional watering-hole operation depends on compromising a website that a target might visit. Access to advertising distribution can potentially place attacker-controlled content across many different destinations, reducing dependence on a single compromised publisher.
That is an analytical comparison between delivery models, not evidence that every website displaying the advertisements was itself hacked or knowingly involved.
The stakes are particularly high when surveillance affects people whose communications contain information about others.
Amnesty’s reporting on the Intellexa Leaks linked the broader spyware problem to threats against privacy, freedom of expression and human rights. It described continuing attacks involving journalists, activists and human rights defenders, including a Predator attack attempt against a lawyer from Pakistan’s Balochistan province in 2025.
The organisation also raised questions about vendor access to customers’ surveillance systems and the responsibility of companies whose products enable abuse.
For a newsroom, the potential consequences include exposure of confidential sources. For a business, they may include sensitive negotiations or internal communications. These are risk implications of endpoint surveillance, rather than findings that those particular losses occurred in the AdFection investigation.
Apple’s guidance on Lockdown Mode offers one example of protections designed specifically for people at heightened risk of sophisticated spyware.
The optional mode restricts selected device functions, including certain web technologies, message attachments and unsolicited communications. Apple recommends updating devices before enabling it and applying the protection across supported devices.
These restrictions involve usability trade-offs: some websites and features may behave differently or become unavailable. Apple describes the feature as intended for the relatively small number of people who could face highly targeted attacks.
Its documentation does not establish that Lockdown Mode defeats every component of this particular campaign. The relevant principle is reducing the functionality available to an attacker, alongside maintaining current software.
For security leaders, the broader lesson is to assess automatic content delivery as part of organisational exposure. Training employees to recognise suspicious messages remains useful, but it cannot be the only safeguard against a threat that does not ask them to make a decision.
The AdFection findings put the advertising supply chain under renewed scrutiny. They also shift attention towards the platforms and intermediaries that decide whose code reaches users’ devices—and how quickly abuse can be identified and stopped.
Look, this exposes a much bigger problem than spyware. And for years, a lot of security thinking has assumed the user is somewhere in the failure chain. Clicked the wrong link. Opened the wrong file. Ignored the warning. Ok, but here, the user may do absolutely nothing wrong. The vulnerability is in the trusted delivery path itself. Once that happens, the question changes from, How do we stop the user from making a mistake? to, How do we govern what trusted infrastructure is allowed to deliver in the first place? And that’s a very different security problem.
Always anticipate compromise. Employees-especially ones working in Sensitive Areas should NOT be browsing Internet sites for any reason. Most Companies have their own intranet sites that are iron clad. Answer is simple, either train your team or risk the consequences of poor security
🎯 Marking a secret as “prompt not blocked” exposes the core flaw of passive telemetry: post-mortem logging is pure compliance theater. When internal staff and autonomous agents feed live API keys into third-party AI models, recording the leak for admin review stops nothing; the secret has already left your perimeter. 🛡 Defending against AI credential loss requires active, real-time client interception that terminates unvetted egress at the endpoint before a sensitive secret ever hits the wire.
Hi, Boštjan Dolinšek.
To view or add a comment, sign in
Security researcher Quentin Kaiser has disclosed a vulnerability affecting Broadcom-based routers that can allow an…
Federal agencies warn that convincing phishing messages, impersonation schemes and synthetic audio and video could help…
A supply-chain attack involving ConnectWise’s cloud services has exposed Microsoft 365 customers to unauthorized…
The U.S.
A critical flaw in BeyondTrust Remote Support allowed suspected Chinese espionage operators to compromise appliances…
The Australian Signals Directorate has introduced ASD Essentials, a broader cybersecurity framework that extends its…
Palo Alto Networks has released security updates for an actively exploited vulnerability in PAN-OS, prompting an urgent…
The OWASP GenAI Security Project’s 2026 Top 10 for Large Language Model Applications puts renewed emphasis on a growing…
Most AI offensive-security agents can plan attacks and write payloads — but they lean on predefined tools and isolated…
Wireshark has released version 4.6.
