Do Son 
Citizen Lab Exposes a New Ad-Based Attack
The Citizen Lab at the University of Toronto has published a report on a new way to deliver commercial spyware through targeted advertising. Researchers named the technique AdFection.
Attackers use the ad bidding system to pick out specific devices. Then they load malicious code the moment an ad appears. The victim never clicks an ad or downloads a file.
The target in this campaign was Al Jazeera, the Qatari state-funded media network.
How Ad Bidding Data Becomes a Weapon
When a website or app loads an ad, a real-time bidding system passes device and display details to the ad platform. Those details may include advertising identifiers, cookies, IP addresses, and app or web page information.
Controlium and Targeted Delivery
According to the report, the Controlium platform can use this data to select target devices. Discover-Tech, an Israeli ad technology company, operates the platform.
A script inside the ad then sends follow-up JavaScript to the chosen device. Combined with a browser vulnerability, that script launches the attack.
Why It Counts as Zero-Click
Experts call this a zero-click attack. The user only has to open a site or app and let the ad load. No click and no download is needed to start the chain.
However, not every ad impression carries malicious code. Researchers say the server decides whether to return a script based on signals such as the device identifier.
At Least 45 Al Jazeera Devices Were Targeted
Citizen Lab traced attacks on Al Jazeera between 2024 and 2025. It used network logs that the broadcaster supplied.
The team links the activity to Discover-Tech advertising and to the commercial spyware Candiru, with high confidence. In total, at least 45 Al Jazeera devices appeared on the target list.
Malware Sample Points to Candiru
The researchers also recovered a malware sample from one infected device. Server details and code traits in the sample tie it to Candiru. This Tel Aviv-based commercial spyware firm is sometimes called Sourgum.
Taken together, the findings show how routine ad infrastructure can serve as a delivery pipeline for surveillance tools.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
