Citizen Lab has uncovered a zero-click spyware campaign, dubbed AdFection, in which Candiru spyware was delivered via targeted online advertisements, notably infecting at least forty-five (45) devices at Al Jazeera between 2024 and 2025. The operation uses Israeli ad firm “Discover‑Tech” as a bridge between mercenary spyware vendors and the ad ecosystem, as claimed in the report published by Citizen Lab. Discover‑Tech’s “Controlium” platform buys placements through mainstream ad exchanges, embedding JavaScript that, when an ad is simply rendered, contacts a “getAd/NOAS” server. Using IP, ad IDs, and other parameters, the server decides whether a device is a target. Once a device is deemed a target, selected users receive additional malicious code that profiles, de‑anonymizes, fingerprints, and, in Candiru’s case, triggers infection with no clicks required. Leaked Discover‑Tech infrastructure exposed billions of bid records, showing its ads on nearly 200,000 websites and apps and directing hundreds of thousands to millions of users to attacker‑controlled domains. Citizen Lab also linked Discover‑Tech to other surveillance actors like Dark Cartographer, which builds databases tying mobile ad IDs to phone numbers. Following the report, Google, IAB Europe, Beeswax, Eskimi, Vungle, and others removed Discover‑Tech from vendor registries and blocked its access.