Research discovers ads capable of installing spyware without the user clicking

An announcement could be enough to start the attack. Citizen Lab has documented infections with Candiru spyware on devices used by Al Jazeera after they received advertising contracted by Discover-Tech. Users did not have to tap the ad: the string was activated when it loaded on a page or app.

The attacks occurred in 2024 and 2025. The news is the publication of the technical analysis, which explains how a company integrated in the advertising market could identify specific people and send them an advertisement different from the one the rest received. Citizen Lab examined network logs provided by Al Jazeera and linked the sequence of connections to Discover-Tech and Candiru infrastructure.

The ad selected who to attack

The operation took advantage of the bidding system with which many advertising spaces are purchased. Discover-Tech could compete to show an ad to a device it was interested in. When loaded, the ad requested JavaScript code from a company server.

The response from that server depended on the recipient. In most cases it did not return code to initiate an infection, although the ad continued to collect data from the browser and device. When it recognized a selected target, it could deliver the content that activated the attack chain. The ad could even load in the background, without the person seeing it.

This distinction is essential to interpret the scope of the case. Just because a device received a Discover-Tech ad does not mean it was infected. Citizen Lab has documented real infections on Al Jazeera and notes that at least 45 devices from that organization were subject to attacks; That figure corresponds to attacked devices, not 45 confirmed infections.

The platform used by Discover-Tech was called Controlium. According to the investigation, it allowed devices to be profiled, associate advertising identifiers with people and select targets for subsequent operations. That capability turned regular ad market information into a surveillance tool.

Four billion records show the reach of the network

The researchers analyzed about 4 billion bid records coming from a Discover-Tech server. For four months, they found advertisements for the company in almost 200,000 websites and apps from different countries. These are places where ads were served, not spyware victims.

Citizen Lab also noted that Discover-Tech ads They directed millions of devices to servers linked to Candiru. The report interprets this traffic as a possible large-scale surveillance and reconnaissance operation. Again, a connection to these servers does not in itself equate to an infection.

The research describes two related uses of the same infrastructure. One involved gathering data to recognize and track devices. The other allowed spyware to be distributed to selected targets. The first could affect many people; the second required identifying the recipient and executing the attack chain on their device.

To reconstruct what happened at Al Jazeera, Citizen Lab compared network logs from the period of the attacks with Discover-Tech domains, the infrastructure attributed to Candiru, and the behavior of the spyware. Infected devices first contacted systems associated with the ad load. That sequence helped link the advertising to subsequent infection.

What advertising platforms have done

After receiving information about the findings, several companies in the advertising sector took action against Discover-Tech. Citizen Lab includes the withdrawal of the provider from certain systems, the blocking of its activity or the suspension of its campaigns. These actions limit the ways described in the report, but do not allow us to affirm that any similar technique has disappeared from digital advertising.

The case also does not demonstrate that visiting one of the almost 200,000 identified websites and applications automatically exposed the user to spyware. The mechanism depended on the device selection and the response of the server controlling the advertisement. That is why the scale of advertising distribution and the number of documented infections must be presented separately.

The research poses a difficult problem for the user: avoiding suspicious clicks would not have stopped these particular attacks. The report reveals for the first time a chain of this type technically documented in real infections.