October 16, 2026
- Targeted ads infected Al Jazeera devices with Candiru spyware without a click. Citizen Lab’s AdFection investigation calls this the first public technical confirmation of an in-the-wild zero-click mercenary-spyware attack delivered through advertising. It says Discover-Tech’s Controlium platform fingerprinted and de-anonymized devices, then let partners trigger infection when an ad rendered. Analysis of four billion bid records over four months found its ads on almost 200,000 unique sites and mobile apps in dozens of countries. Millions of devices contacted Candiru infrastructure, which researchers characterize as likely tracking and reconnaissance rather than evidence of mass infection. The Citizen Lab report includes the recovered sample and technical indicators. (discussion) · Threat Activity & Espionage
in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware