AdFection Needs No Click
An advert can deliver spyware without a click. Citizen Lab’s 15 October AdFection report links Al Jazeera’s 2024-25 attacks to Candiru via Discover-Tech with high confidence.
At least 45 devices were targeted, not all confirmed infected. The government customer remains unidentified.
What the evidence connects
Selected devices received JavaScript when adverts rendered. Logs connected advertising contact, Candiru validation and command-and-control; a recovered Windows library supported attribution.
Confiant’s independent investigation, covering 1 April to 10 September 2026, found device fingerprinting and encrypted instructions capable of running operator-supplied code in the advert context. It observed hand-offs to Candiru-attributed infrastructure, but did not capture a complete exploit chain in the wild.
Confiant estimates roughly ten million impressions daily across the wider Discover-Tech operation. The rarer Candiru hand-offs were a separate subset, observed in nine countries, mainly on residential or mobile networks. Those reach figures are not infection totals.
Keep the findings separate
For a device investigation, retain browser artefacts, proxy and DNS logs, endpoint evidence and timestamps before local changes obscure the sequence. Record which observations establish exposure, which support malicious selection, and which demonstrate compromise. Give the incident responder the evidence and its gaps, not a single undifferentiated list of affected devices.
Google terminated Discover-Tech’s exchange access; other platforms removed, paused or blocked it. That does not establish clearance of every delivery route or earlier infection.
Primary research
- Citizen Lab, 15 October 2026
- Confiant, 15 October 2026
