AdFection Spyware: Why Avoiding Ad Clicks Is Not Enough

Citizen Lab's 15 October investigation describes a technique it calls AdFection: using targeted advertising to deliver mercenary spyware without an ad click. The researchers link infections at Al Jazeera to Candiru spyware delivered through advertisements purchased by Discover-Tech. They describe this as the first public technical confirmation of this particular spyware delivery method.

The Al Jazeera attacks examined took place in 2024 and 2025, with at least 45 devices targeted. That is a targeting count, not a claim that all 45 were infected. The news is the newly published investigation, not evidence that those attacks began this week.

An online advertisement can run code as well as display an image. Citizen Lab describes ads that sent advertising identifiers and IP addresses to Discover-Tech servers. Selected devices could then receive additional code leading to exploitation and spyware installation. The visible advert did not have to contain the exploit itself, which helped conceal the chain from the platforms serving it.

The report also describes much broader profiling activity. It explicitly warns that seeing a Discover-Tech advertisement does not, on its own, confirm spyware targeting or infection. Do not turn a list of websites, apps or organisations where ads appeared into a list of confirmed victims. For an individual reader, visiting a named website is not a diagnosis.

Citizen Lab recommends a trusted ad-blocking browser extension, privacy-respecting browsers, reduced ad tracking and mobile advertising-ID controls. Use your browser's official extension store and check the publisher and permissions rather than installing a blocker from an unsolicited advert. Browser blocking does not automatically cover ads inside separate mobile apps.

Review the advertising and tracking settings on your phone; the available reset, deletion and opt-out controls vary by platform. Keep the operating system and browser updated as basic security hygiene, without treating an update or a clean scan as proof that sophisticated spyware is absent. These are risk-reduction measures, not a guaranteed cure.

If your work or circumstances put you at elevated risk of targeted surveillance, Citizen Lab recommends expert help. Journalists and civil-society staff should use an established security team or trusted specialist rather than rely on an online spyware checker.

A VPN protects the network path to its server and changes the public IP address websites normally see. It does not automatically remove advertising IDs, browser identifiers or malicious code delivered to an app. Citizen Lab explains that advertising identifiers can link activity across changes between cellular networks, Wi-Fi and VPNs.

The researchers include network-level ad blocking and trusted VPN services with ad-blocking features among possible precautions. That filtering is a separate capability from the encrypted tunnel: check that it exists and is enabled, and do not assume it stops every ad or exploit. A VPN cannot clean an already infected device.

Citizen Lab says Google and IAB Europe removed Discover-Tech from their ad-vendor lists, while Google and Beeswax ended its access to their ad systems. Those actions matter, but they do not establish that ad-delivered spyware as a class has disappeared. The useful takeaway is to reduce unnecessary advertising exposure without mistaking reduced exposure for immunity.