Spyware Campaign Exploits Online Ads to Target Users, Report Reveals

WHO:

NBC News - Researchers at Citizen Lab, an operation at the University of Toronto, and Confiant, a U.S. ad security company.

NBC News - DiscoverTech, an Israeli ad company based in Tel Aviv, involved in placing hacking software on popular websites.

NBC News - Natalia Krapiva, a spyware expert at the digital rights nonprofit Access Now.

NBC News - Wolfie Christl, a researcher at Citizen Lab.

WHAT:

NBC News - The report indicates that the spyware campaign named AdFection is the first documented instance of mercenary spyware being distributed via online advertising.

NBC News - DiscoverTech has served ads on almost 200,000 websites, including major media organizations, search engines, government agencies, and dating services.

NBC News - Five ad vendors and industry organizations, including Google, IAB Europe, Beeswax, Vungle, and Eskimi, disconnected DiscoverTech from their platforms following the report's findings.

NBC News - The report states that the malicious code used to hack Al Jazeera computers was particularly effective because it was "no-click" spyware, meaning a victim did not need to download a file or even click a link to be infected, just visit a website with a vulnerable computer and see the ad.

NBC News - The report from Citizen Lab indicates that the spyware campaign named AdFection infected dozens of devices at Al Jazeera, marking the first time technical evidence of such spyware being distributed via online advertising has been released.

NBC News - The report states that DiscoverTech served ads on networks of major government entities, including the U.S. Defense Department and the Dutch Economic Affairs Ministry, although the presence of ads does not indicate those organizations were targeted in malicious campaigns.

NBC News - The researchers found that Candiru, an Israeli spyware company now operating as Integrity Labs, used DiscoverTech’s ads to deliver its spyware. The U.S. Commerce Department added Candiru to its Entity List in 2021, citing that foreign governments had used its software to target journalists, activists, and government officials.

NBC News - The report says Confiant detected DiscoverTech ads served on networks of major government entities like those of the U.S. Defense Department and the Dutch Economic Affairs Ministry, though it emphasized that the presence of ads does not indicate those organizations were targeted in malicious campaigns.

NBC News - The researchers say DiscoverTech taps into that system to offer a secret program called Controlium, which allows spyware companies to use DiscoverTech’s ad network to identify people to hack and help them deliver the malicious code to take over their devices.

NBC News - The researchers found that Candiru, an Israeli spyware company that now operates as Integrity Labs, used DiscoverTech’s ads to deliver its spyware. The U.S. Commerce Department added Candiru to its Entity List in 2021, saying foreign governments had used its software to target journalists, activists, and government officials.

NBC News - Wolfie Christl, one of the Citizen Lab researchers behind the report, stated, "I think that our findings confirm once again that ad blocking must be considered a cybersecurity best practice."

Wired - The report from Citizen Lab indicates that the spyware campaign named AdFection is the first documented instance of mercenary spyware being distributed via online advertising.

NBC News - The report states that DiscoverTech served ads on almost 200,000 websites, including major media organizations, search engines, government agencies, and dating services.

NBC News - The researchers found that Candiru, now operating as Integrity Labs, used DiscoverTech’s ads to deliver its spyware, which has been linked to targeting journalists and activists.

NBC News - The report from Citizen Lab indicates that the spyware campaign named AdFection infected at least 45 devices at Al Jazeera, marking the first time technical evidence of such spyware being distributed via online advertising has been released.

NBC News - Al Jazeera provided network logs from the period of the attacks, which researchers used to reconstruct how they unfolded.

NBC News - DiscoverTech's ads were detected on networks of major government entities, including the U.S. Defense Department and the Dutch Economic Affairs Ministry, although the presence of ads does not indicate those organizations were targeted in malicious campaigns.

NBC News - Five ad vendors and industry organizations disconnected DiscoverTech from their platforms following the report's findings, including Google, which banned DiscoverTech from its Google Ads platform.

NBC News - DiscoverTech's program, Controlium, allowed spyware companies to select specific individuals to target using their advertising IDs, browser identifiers, or IP addresses.

NBC News - Google has banned DiscoverTech from its Google Ads platform following the findings of the Citizen Lab report.

NBC News - The report from Citizen Lab indicates that the malicious code used to hack Al Jazeera computers was particularly effective because it was "no-click" spyware, meaning a victim did not need to download a file or even click a link to be infected, just visit a website with a vulnerable computer and see the ad.

NBC News - Wolfie Christl, a researcher at Citizen Lab, stated, "I think that our findings confirm once again that ad blocking must be considered a cybersecurity best practice."

NBC News - A report published by Citizen Lab details a zero-click spyware campaign named AdFection, which infected at least 45 devices at Al Jazeera.

NBC News - The spyware used was described as "no-click," meaning victims did not need to download a file or click a link to be infected.

NBC News - DiscoverTech served ads on almost 200,000 websites, including those of major media organizations and government agencies.

NBC News - Five ad vendors and industry organizations disconnected DiscoverTech from their platforms following the report's findings.

WHERE:

NBC News - Al Jazeera, the media organization targeted by the spyware campaign.

NBC News - DiscoverTech is based in Tel Aviv, Israel.

WHEN:

NBC News - The hacks targeting Al Jazeera occurred in 2024 and 2025.

NBC News - The report was published on a Thursday.

WHY:

NBC News - The report indicates that spyware is often leased to governments to help them hack devices of individuals they wish to spy on, including journalists and human rights advocates.

HOW:

NBC News - Researchers found source code on DiscoverTech's login pages that revealed aspects of how the Controlium program operates, allowing spyware companies to select specific individuals to target using their advertising IDs, browser identifiers, or IP addresses.

NBC News - The researchers discovered source code on DiscoverTech's login pages that revealed aspects of the Controlium program, which allowed spyware companies to select specific individuals to target using their advertising IDs, browser identifiers, or IP addresses.

NBC News - The researchers found source code on DiscoverTech's login pages that revealed aspects of how the Controlium program operates.

NBC News - DiscoverTech secretly ran a program called Controlium, allowing spyware companies to use its ad network to identify and hack individuals.

NBC News - The malicious code used to hack devices was delivered through online ads without user interaction, exploiting vulnerabilities in the victims' devices.

(UPDATED October 15, 2026 22:58 UTC)

A new report reveals that a spyware campaign named AdFection marks the first documented case of mercenary spyware being distributed through online advertising. DiscoverTech, which has placed ads on nearly 200,000 websites including major media outlets and government agencies, has been disconnected from several platforms like Google and Vungle following these alarming findings. Researchers discovered that the malicious code used to hack Al Jazeera's computers was particularly insidious, as it operated as "no-click" spyware, allowing infection simply by visiting a compromised website without any need for the victim to download a file or click a link.

(UPDATED October 15, 2026 19:03 UTC)

A new report from Citizen Lab reveals that a spyware campaign named AdFection has infected numerous devices at Al Jazeera, marking the first time technical evidence of such spyware being distributed through online advertising has been documented. The report highlights that DiscoverTech served ads on networks associated with major government entities, including the U.S. Defense Department, although this does not imply those organizations were specifically targeted. Researchers also found that the Israeli spyware company Candiru, now operating as Integrity Labs, utilized DiscoverTech’s ads to deliver its spyware, reinforcing the idea that ad blocking should be viewed as a crucial cybersecurity measure.

(UPDATED October 15, 2026 17:58 UTC)

A new report from Citizen Lab reveals that a spyware campaign named AdFection is the first known instance of mercenary spyware being distributed through online advertising. The investigation found that DiscoverTech served ads on nearly 200,000 websites, including major media outlets and government agencies, which were used by Candiru, now known as Integrity Labs, to deliver spyware targeting journalists and activists. Researchers uncovered source code on DiscoverTech's login pages that detailed the Controlium program, enabling spyware companies to select specific individuals to target based on their advertising IDs, browser identifiers, or IP addresses.

(UPDATED October 15, 2026 16:01 UTC)

A new report from Citizen Lab reveals that the spyware campaign known as AdFection has infected at least 45 devices at Al Jazeera, marking a significant development as it is the first time technical evidence of such spyware being distributed through online advertising has been documented. Al Jazeera provided network logs that researchers analyzed to reconstruct the timeline of these attacks, while DiscoverTech's ads were found on networks of major government entities, including the U.S. Defense Department, although this does not imply those organizations were targeted. In response to the findings, five ad vendors and industry organizations, including Google, have severed ties with DiscoverTech, which was also banned from the Google Ads platform.

(UPDATED October 15, 2026 14:00 UTC)

A new report from Citizen Lab reveals that the spyware campaign known as AdFection has infected numerous devices at Al Jazeera, marking a significant breakthrough as it provides the first technical evidence of spyware being distributed through online advertising. The report also highlights DiscoverTech's program, Controlium, which enabled spyware companies to target specific individuals using their advertising IDs, browser identifiers, or IP addresses, with researchers uncovering source code on DiscoverTech's login pages that sheds light on how the program functions. In response to these findings, Google has taken action by banning DiscoverTech from its Google Ads platform.

(UPDATED October 15, 2026 13:07 UTC)

A recent report from Citizen Lab reveals that Al Jazeera's computers were hacked using no-click spyware, which infects victims simply by visiting a vulnerable website. The report also highlights that DiscoverTech served ads on networks associated with major government entities, including the U.S. Defense Department, although this does not imply those organizations were specifically targeted. Researcher Wolfie Christl emphasized the importance of ad blocking as a crucial cybersecurity measure in light of these findings.

(UPDATED October 15, 2026 12:00 UTC)

A new report from Citizen Lab reveals a zero-click spyware campaign named AdFection that infected at least 45 devices at Al Jazeera, with the spyware being delivered through online ads without any user interaction. The Israeli ad company DiscoverTech, which served ads on nearly 200,000 websites, has been linked to this campaign, prompting five ad vendors and industry organizations to cut ties with them following the findings. The report highlights how spyware is often leased to governments to target individuals such as journalists and human rights advocates, with DiscoverTech's program Controlium enabling the identification and hacking of these targets.