Targeted ads reportedly delivered Candiru spyware without a click

Selecting target devices through connections on ad rendering

According to the report, Citizen Lab called the technique AdFection. It said Discovere-Tech bought advertising placements and embedded JavaScript that contacted a server when an ad rendered. The server allegedly used device-related parameters to decide which devices received additional code. Al Jazeera provided evidence of attacks targeting at least 45 devices between 2024 and 2025, and researchers recovered a DLL from a compromised Windows system that they attributed with high confidence to Candiru.

The supplied report describes Citizen Lab's finding as the first public technical confirmation of mercenary spyware being delivered through targeted advertisements. It does not provide a like-for-like prior infection baseline.

The reported finding adds a publicly documented delivery route: advertisements could selectively send further code to chosen devices when the ads were rendered, without a click. Citizen Lab linked one observed campaign against Al Jazeera Media Network devices to Candiru.

The report describes a selective spyware-delivery route through the online advertising ecosystem rather than a user click. It also distinguishes the reported observed campaign from infection counts: its figures for ad auctions, apps, websites, and users directed to domains do not establish how many devices were infected.