Researchers at Citizen Lab have documented the first public technical confirmation of mercenary spyware distributed through targeted online advertisements. The Candiru spyware was delivered to devices at Al Jazeera Media Network through a technique called AdFection, which infected targets without requiring them to click anything. The attack was facilitated by Israeli firm Discover-Tech, which used its Controlium platform to embed malicious code in advertisements purchased through mainstream ad networks and exchanges.
Between March and June 2026, the advertising operation placed billions of ad bids and won millions of auctions, with potentially hundreds of thousands to millions of users directed to attacker-controlled domains. Evidence from Al Jazeera showed that at least 45 devices were targeted between 2024 and 2025. After Citizen Lab reported its findings, major advertising companies including Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked associated domains.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
