BREAKING
4 in 5 school buses in Delhi caught speeding, some hit 79 km/h: Study raises safety alarmNITK, EMPRI join hands to develop mangrove-based carbon credit projectsDelhi Police detain CJP leader Dipke, AISA chief Neha BohraJailer 2 OTT release date: When and where to watch Rajinikanth, Vidya Balan’s film onlineKharge writes to PM Modi, urges him to hold all-party meeting on delimitation proposalsDelhi Police detain CJP leader Abhijeet Dipke ahead of Connaught Place protestSalman Khan brings up old Shah Rukh Khan feud on Koffee With Karan 9: ‘It was not good’Probe ordered into ‘irregularities’ in Kolar, Aliyabad and Amalapur gram panchayatsOver 6,000 Police Personnel, CCTV cameras deployed ahead of ‘Lehra Do Tiranga’ March in DelhiRanabaali Twitter review: Is Vijay Deverakonda-Rashmika Mandanna film a hit or a flop? Find out here
Technology

Online ads infected Al Jazeera devices with zero-click spyware, report says

hellohimachalse@gmail.com 16 Oct 2026 1 hour ago

A new investigation says online advertisements were used to infect devices at Al Jazeera with mercenary spyware, without requiring victims to click a link or open a file. Citizen Lab calls the technique “AdFection” and describes it as the first publicly documented zero-click spyware infection delivered through targeted ads.

The researchers said at least 45 devices at the Qatar-based news network were targeted and infected in 2024 and 2025. They linked the campaign with high confidence to spyware from Candiru, which has rebranded as Integrity Labs, and to advertising infrastructure operated by Israel-based Discover-Tech.

:

How the zero-click ad attack worked

Online advertising platforms run automated auctions whenever an ad space loads on a website or app. Citizen Lab Discover-Tech used this system to place apparently ordinary ads on selected devices. Code embedded in the ad contacted the company’s servers and collected identifiers such as an IP address, mobile advertising ID or browser cookie.

If the device matched a selected target, the system could return malicious JavaScript and route it to a spyware delivery server. The victim did not need to tap the ad. Citizen Lab said network logs supplied by Al Jazeera showed the sequence from a Discover-Tech ad impression to Candiru-linked infrastructure and subsequent spyware activity.

:

Why the discovery matters

Advertising systems reach a vast number of websites and apps, giving surveillance operators a way to profile users at scale before narrowing in on particular people. The researchers analysed about four billion bidding records and found Discover-Tech ads across almost 200,000 websites and mobile apps during four months.

Discover-Tech has not publicly answered the allegations. Reuters reported that Google and ad platform Beeswax removed the company from their systems, while IAB Europe suspended it from an approved-vendor list.

The findings are serious, but they remain allegations based on technical research, not a court ruling.

Related News