Targeted ads installed Candiru spyware in zero-click attacks

Researchers at Citizen Lab identified a zero-click attack technique called AdFection, where targeted online advertisements delivered Candiru spyware by executing malicious JavaScript upon ad rendering. The ads contacted a server to determine if the device was a target, delivering additional malicious code only to selected devices to maintain stealth. Evidence from Al Jazeera Media Network showed at least 45 devices targeted between 2024 and 2025, with recovered malware samples attributed to Candiru. The operation involved Discover-Tech, an Israeli firm acting as a bridge between spyware vendors and the advertising ecosystem, purchasing ad placements through mainstream networks. The campaign placed 3.77 billion bids and won 442 million auctions between March and June 2026, with malicious ads appearing across over 75,000 Android/iOS apps and 120,000 websites. Following Citizen Lab's report, major ad companies took steps to block the malicious activity.

The attack enabled delivery of Candiru spyware to targeted devices without any user interaction, potentially compromising device security and privacy. The spyware is capable of stealing files, credentials, and messages. At least 45 devices at a high-profile media organization were confirmed targets, with the broader advertising campaign potentially exposing millions of users to malicious domains. The stealthy nature of the attack, delivering payloads only to selected targets, complicates detection and mitigation.

Major advertising companies including Google, IAB Europe, Beeswax, Eskimi, and Vungle have removed offending accounts and blocked access to malicious domains following disclosure. Organizations should monitor for suspicious ad activity and coordinate with ad networks to prevent malicious ad placements. Since the attack relies on targeted ads and malicious JavaScript execution, blocking or filtering suspicious ad content and scripts can help reduce risk. No official patch or fix is applicable as this is an attack technique leveraging the advertising ecosystem rather than a software vulnerability.