Key points
- Al Jazeera devices were targeted by Candiru spyware via Discover-Tech advertisements.
- The Controlium platform enables device fingerprinting and zero-click exploitation.
- Billions of bid records were exposed, revealing widespread ad deployment.
The attacker gains full device surveillance by exploiting the advertising ecosystem, requiring only that the victim sees a targeted ad. This zero-click approach removes the need for user interaction, allowing silent compromise through standard web browsing or app usage.
Citizen Lab reports that Candiru spyware infected devices at Al Jazeera through targeted advertisements served by Discover-Tech. The operation, named AdFection, used these ads to de-anonymise, fingerprint and track devices at scale, facilitating the infection process without requiring clicks.
The advertising vector
Discover-Tech’s Controlium platform acts as a bridge between ad vendors and mercenary spyware operators. It enables the de-anonymisation of millions of users by collecting extensive device and user data from real-time bidding auctions. This data allows threat actors to profile individuals and track them across nearly two hundred thousand websites and applications worldwide.
Scope of exposure
Between 2024 and 2025, at least forty-five devices within Al Jazeera were targeted in these attacks. Citizen Lab identified a server exposing four billion ad bid records, indicating the sheer scale of Discover-Tech’s reach. While the firm appears to work with multiple partners, its use for profiling and infecting users on behalf of Candiru is confirmed.
What happens next
Security teams should monitor for unusual network connections to known advertising infrastructure. Analysts may look for scripts that submit advertising identifiers and execute JavaScript based on IP addresses. There is no confirmed fix or patch for this specific campaign method, so defensive monitoring remains the primary response while vendors address underlying vulnerabilities.
Why this attack works
This technique exploits the inherent trust and data collection mechanisms of the digital advertising ecosystem. By leveraging real-time bidding platforms, attackers can correlate multiple data points to uniquely identify devices. This allows for precise targeting without user consent or interaction. Teams usually check for anomalies in ad-related traffic and monitor for unexpected device fingerprinting scripts that may precede exploitation attempts.
Background: Spyware
Small organisations face spyware because they lack dedicated security staff to monitor unusual behaviour. You can reduce risk by enforcing strict application allow-listing, segmenting networks, and ensuring your IT provider logs and reviews endpoint telemetry, not just antivirus alerts.
Read the full guide: Spyware in Small Business: Hidden Risks and Practical Defences
What to do and how to stay safe: Candiru
- Monitor network logs for connections to advertising domains associated with data collection.
- Review browser and app permissions to limit exposure to tracking scripts.
- Check for unusual JavaScript execution patterns that correlate with ad impressions.
- Isolate devices that show signs of interaction with known mercenary ad platforms.
Step-by-step guide: Endpoint Detection and Response (EDR): How It Works and Why You Need It
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Discover-Tech help deliver spyware?
Its Controlium platform fingerprints devices and serves malicious ads that exploit vulnerabilities for zero-click infections.
Which organisation was targeted?
Al Jazeera staff devices were targeted, with at least forty-five infections reported between 2024 and 2025.
Is Discover-Tech a legitimate company?
It appears to be a front for espionage campaigns, bridging ad vendors and spyware operators like Candiru.
