Verify Al Jazeera Devices After Zero-Click Ad-Based Spyware Campaign

Citizen Lab confirmed the first public instance of zero-click mercenary spyware delivered through targeted online advertisements. The research team labeled this delivery method AdFection. The campaign affected devices at Al Jazeera, installing Candiru spyware. An Israeli ad-tech company named Discover-Tech purchased the advertisements used in this intrusion. This method requires no interaction from the device owner to execute the malicious code.

Root cause

The vulnerability stems from how real-time ad auctions operate. These auctions run in under a second and transmit device IDs, IP addresses, and location data. Advertisers can use this data to target specific individuals. The ads contained code that executed inside the browser or app displaying them. Citizen Lab found that many ads from Discover-Tech included a script tag. This script contacted a server known as NOAS. The ad sent the user’s cookie ID or mobile ad ID to that server for processing.

Attack path

The NOAS server returned JavaScript only to eligible targets. It used IP addresses and ad identifiers to determine eligibility. All other users received a zero-byte response. This design kept malicious code hidden from ad vendors. Network logs showed a consistent sequence. The device first contacted Discover-Tech infrastructure to mark an ad impression. Then it connected to a Candiru validator server for an initial check. Finally, it contacted a Candiru command-and-control server.

Affected versions

Al Jazeera recovered a Windows DLL from a compromised device. The file hardcodes command-and-control servers fearevolve[.]com and jobmarcher[.]com. It persists through a COM hijack technique. Strings in the file are obfuscated with a 48-byte repeating XOR key. These traits match the Candiru toolchain from 2021. Citizen Lab linked the 2024–2025 attacks to Candiru, now rebranded as Integrity Labs, with high confidence. At least 45 Al Jazeera devices were targeted in this specific operation.

Mitigation

• Monitor network traffic for connections to known Candiru command-and-control domains.
• Audit ad-tech integrations for unauthorized script executions or callback servers.
• Review authentication configurations for third-party platforms like Controlium.
• Check for COM hijack persistence mechanisms in Windows environments.
• Validate that ad vendors do not expose user identifiers to external servers.

For customers and users

Organizations should verify whether their ad-tech platforms expose sensitive device identifiers. Teams usually review server logs for unexpected outbound connections to unknown domains. Users should check whether their browsers allow scripts from ad networks to access local data. It is important to recognize that follow-up scams often claim to fix such breaches. These messages typically arrive via email or phone shortly after the incident. Do not click links in unsolicited messages offering immediate remediation. Instead, contact your security team directly through known channels.

What to do and how to stay safe: Candiru

• Review browser permissions to limit data sharing with ad networks.
• Check network logs for connections to unfamiliar command-and-control servers.
• Verify that ad-tech platforms are not exposing cookie or device IDs.
• Monitor for unauthorized scripts executing in web browsers or apps.

Step-by-step guide: Offline Backup Mistakes That Break Ransomware Recovery

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the AdFection technique?

AdFection is a method where zero-click spyware is delivered via targeted online ads that execute malicious code without user interaction.

Which spyware was used in this campaign?

The campaign used Candiru spyware, which is now rebranded as Integrity Labs, to infect targeted devices.

How many devices were affected?

At least 45 devices at Al Jazeera were targeted in the 2024–2025 campaign.