Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks delivered via targeted advertisements, according to Canadian internet watchdog group Citizen Lab. Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in what Citizen Lab calls AdFection attacks leading to Candiru's spyware.
What happened
The targeting ran through the advertising supply chain rather than through email or messaging. Citizen Lab says it identified a Discover-Tech server that exposed four billion ad bid records. Those records revealed that Discover-Tech's ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide.
In early October, Google and IAB Europe removed the company from their ad vendor registries, Google blocked Discover-Tech's access to its ad exchange platforms, and Beeswax and Eskimi took similar measures.
Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in AdFection attacks leading to Candiru's spyware.
How it was done
The delivery path was targeted advertising. Ads bought through an ad vendor were served to selected devices, and the infection required no interaction from the person using the device. That is what zero-click means here: viewing a page or using an app that carried the ad was enough.
The exposed bid records are the part engineering teams should sit with. Bid requests carry device and user signals, and a large store of them describes who can be reached, where and when. The same reach that makes an ad network valuable to advertisers makes it a distribution channel if it is abused.
What to check
If your organisation has staff who are plausible targets, or if you run ad slots in your own products, these are reasonable things to verify this week.
List the ad vendors loading in your own properties
Open your consent management or tag manager configuration and export the full vendor list, including vendors added through header bidding partners. Compare it against the IAB Europe vendor list and your ad exchange's approved seller files. Any vendor you cannot trace to a contract or a business owner is a bad result.
Capture what actually renders, not what is configured
Load key pages in a clean browser profile with the network tab recording, or run a headless crawl with Puppeteer and log every third party request. Diff the observed domains against your approved vendor list weekly. Domains that appear only for some geographies or some user agents deserve a closer look.
Confirm mobile fleet patch levels
Pull the OS version report from your MDM for all iOS and Android devices. Filter for anything more than one minor release behind current. Devices belonging to journalists, executives, legal and policy staff should be at zero exceptions.
Turn on the hardened modes the platforms already ship
For high risk users, enable Lockdown Mode on iOS and Advanced Protection on Android, and enforce it through MDM policy rather than asking people to opt in. Verify enrolment in the device compliance report. Users who declined or silently disabled it are the gap.
Keep mobile telemetry you can actually look back through
Collect sysdiagnose archives or Android bug reports for high risk devices on a schedule and store them centrally. Without retained device logs there is nothing to examine after the fact. Check how far back your current retention really goes before you need it.
Review what your own bid requests expose
If you sell inventory, inspect a sample of outgoing bid requests and the fields you populate, including device identifiers, precise location and user agent. Confirm which downstream partners receive them and under what contract. Fields you cannot justify should be dropped at the source.