Citizen Lab finds Candiru spyware delivered through targeted ads, no click needed

Citizen Lab published findings this week documenting what it describes as the first publicly confirmed real-world case of mercenary spyware delivered through targeted online advertising, with no user click required. The research traces spyware infections on at least 45 devices at Al Jazeera Media Network, logged by the broadcaster between 2024 and 2025, back to Candiru, an Israeli vendor that says it sells exclusively to governments.

According to Citizen Lab, an Israeli firm called Discover-Tech purchased ordinary ad placements through mainstream advertising networks and exchanges. The ads contained embedded JavaScript that contacted a Discover-Tech server, internally named "NOAS," as soon as the ad rendered on a device — no click necessary. That server checked signals like the device's IP address and ad identifiers to decide whether it matched a target profile. Devices that matched received additional malicious code; devices that didn't received nothing, which Citizen Lab says is what kept the operation from being noticed sooner. Network logs showed traffic moving from Discover-Tech's infrastructure to Candiru validation servers and then to spyware command-and-control infrastructure. Citizen Lab calls the delivery technique "AdFection."

Candiru's Windows malware, known as DevilsTongue, can steal files, credentials, and messages once installed. The vendor's tools have previously been documented in attacks against journalists, activists, and politicians using Windows and Chrome zero-day exploits. Citizen Lab recovered a malicious DLL file from a compromised Windows system and attributed it to Candiru with high confidence based on infrastructure and code overlaps with previously captured samples. The firm also describes Discover-Tech's "Controlium" platform as allowing clients to target specific devices and profile, deanonymize, and fingerprint users, and says Discover-Tech works with multiple spyware, hacking, and advertising vendors beyond Candiru alone.

The scale of the ad operation is what distinguishes this from a narrowly targeted hack: between March and June 2026 alone, it placed 3.77 billion bids and won 442 million ad auctions, with scripts carrying the attacker's tags appearing across more than 75,000 mobile apps and over 120,000 websites. Citizen Lab stresses those figures describe ad exposure, not confirmed infections, but estimates that hundreds of thousands to millions of users were directed toward the attack infrastructure through Discover-Tech-placed ads at some point.

Following Citizen Lab's disclosure, Google, IAB Europe, Beeswax, Eskimi, and Vungle removed the offending advertiser accounts and blocked access to the domains involved. As first reported by BleepingComputer, the case echoes a similar ad-based delivery method called "Aladdin," documented by Amnesty International in late 2025 for Predator spyware — though that earlier finding relied on leaked internal files rather than observed live attacks, making this the first time the technique has been confirmed through real-world traffic.