AdFection: how ads delivered spyware without a click

1 Code arrives before a click

Websites and apps sell advertising space through intermediaries. Buyers use real-time bidding to decide whether to purchase a particular impression. A bid request can carry an IP address, device information, a mobile advertising identifier or a browser identifier. The buyer receives an opportunity to reach a particular device at a particular ad slot and can select on those attributes. The delivered advertisement can contain both an image and a script. Loading the advertisement can run the script without a click on the banner.

Confiant's advertising observations cover April 1 through September 10, 2026. An advertisement captured on April 12 placed a conventional MyIPInfo banner inside a link, accompanied by a separate getAd script request. The link handles a later click. The script tag fetches code on loading. Its parameters already include an advertising identifier, page, country, operating system and device information. Whether anyone clicks the banner does not prevent that earlier request.

Discover-Tech calls the code-returning service NOAS. Citizen Lab's analysis of tags, frontend code and responses shows how the server can use identifiers and IP addresses to decide what comes next. Most visitors receive an empty response. Selected devices receive further code. This complicates inspection because a scanner and a target can request the same address and receive different answers. Citizen Lab also observed deliveries that returned content once, then nothing on subsequent visits until retasked.

The next stage Confiant observed created a 1×1 iframe, loaded a CloudFront page and brought in approximately 90 KB of obfuscated JavaScript. This SDK checks device capabilities and collects device, network and behavioral information as instructed remotely. Pointer movement, page visibility and keyboard timing can help distinguish a person using the device from an automated scanner. A listed capability does not mean every advertising frame can access the corresponding data. Origin and permission restrictions still apply.

The instruction channel has its own protections. The analyzed SDK uses ECDH to establish a shared key between the browser and the controller for decrypting downloaded code. Results are encrypted with a fresh AES key, which is then wrapped with the controller's RSA public key. Other observers in the advertising chain have difficulty reading collected results even if they see the transmission. The operator can also have the SDK execute supplied JavaScript through new Function(...), while device profiling helps reserve later code for a small set of targets. Execution at this point still has the advertising frame's authority. System compromise needs further exploitation.

This makes a reassuring manual visit a weak check. The visitor may simply fail the selection rules or arrive after the effective delivery. In its October 14 response to Citizen Lab, Eskimi said these tags varied content with device, IP and location, with some campaigns restricted to narrow IP lists, enabling them to pass third-party scanning. That is the platform's account of its own handling, consistent with the selective responses observed by the researchers.

2 Login data can leave without a browser exploit

A second data path is more direct. Confiant found advertisements calling getCookies() to read document.cookie, then attaching the result and device information to advertising requests. What they collect depends on whose page environment runs the code.

Browsers isolate documents by origin, defined by scheme, host and port. A cross-origin iframe cannot directly access the publisher's parent.document. Cookies have their own scope, however. Ports do not isolate them, and subdomains sharing a cookie's Domain may read the same cookie. The frame's own call to document.cookie still depends on which values its document can access. Advertising code written into the publisher page, or placed in a friendly iframe sharing its origin, can also acquire access to the page itself. Downloading a script from an external address does not automatically give it an isolated execution environment.

Cookie attributes matter too. document.cookie exposes cookies visible to the current document that lack HttpOnly. If a login session falls in that readable set, the advertising code can extract its value. The resulting account risk depends on how the service validates and uses that session. Secure restricts transport and SameSite controls cross-site sending. Neither replaces the JavaScript-read restriction provided by HttpOnly. Even with the session cookie hidden, same-origin external code may reach other page data.

Across unique advertising sessions on more than 1,000 publisher domains, Confiant observed first-party cookie collection. Besides analytics and advertising identifiers, captured values included some logged-in users' session IDs and occasionally emails and full names inside JWTs. With the authority granted by those pages, advertisements could already obtain data they should not have received, without waiting for a browser zero-day.

SafeFrame's design isolates advertising code from publisher code and provides a controlled API for information the publisher chooses to share. Remediation therefore needs to inspect the actual frame, its origin relative to the main page and the data exposed through interfaces. Merely finding an iframe on the page answers none of those questions. For login and account pages, a concrete starting point is to reduce third-party scripts, mark sensitive session cookies HttpOnly and inspect the actual loading chain and data visibility in a browser.

3 Which devices were actually infected?

Cookie collection establishes one kind of data loss. Spyware infection needs the device or network evidence to continue the story. Al Jazeera supplied Citizen Lab with logs covering the attack period. On infected devices, the researchers identified a sequence: contact with Discover-Tech advertising infrastructure, then a Candiru validation server, then communication with a Candiru command-and-control server. The validator performs an initial device check before further profiling and infection. Advertising contact alone falls short of those later observations.

Citizen Lab records at least 45 Al Jazeera devices targeted during 2024 and 2025. Al Jazeera also recovered a DLL from one compromised Windows device among them. Servers behind two hardcoded control domains returned responses matching the researchers' C1 fingerprint. COM hijacking gives the spyware DLL another opportunity to run when the system loads a component. The sample and a 2021 Candiru sample use different XOR keys, but both hide strings with a repeating 48-byte key and discard a distinctive trailing null character without decrypting it. Their connectivity-check address lists also have the same order, www.google.com followed by www.microsoft.com. Individual techniques can appear in unrelated programs. This combination, together with the infrastructure and log sequence, supports Citizen Lab's high-confidence identification of the sample as Candiru spyware.

“Zero-click” describes the lack of a required click for delivery to begin. Al Jazeera's logs and device sample provide the infection evidence. Confiant explicitly says it did not capture a complete exploit chain in the wild. Its SDK analysis explains selective delivery of further JavaScript. The published account has not shown the complete sequence identifying the browser vulnerability used by that later code and how it obtained execution within the system.

The much larger figures concern a different dataset. Citizen Lab analyzed approximately 3.77 billion MyDSP bids from March through June 2026, with records indicating approximately 442 million wins. It identified likely NOAS-tagged campaigns by their ad names and found those advertisements actually displayed across 75,373 apps and 120,768 websites. These are deduplicated delivery properties, not infected people. They also do not establish that the publishers knowingly participated in espionage.

An impression on a government organization's network initially identifies that network exit. It does not identify the selected person or establish an institutional breach. Confiant notes that the user could be on a guest network or a shared exit. Defenders can use such records to narrow the devices worth investigating, then correlate validation, later communications and host evidence. Counting all advertising contact as compromise buries the smaller, consequential sequence inside a much larger number.

4 Limit what an advertisement can reach

There has already been action within the supply chain. According to Citizen Lab's October 15 publication, Google removed Discover-Tech's registrations and terminated its advertising exchange access in the first week of October. IAB Europe removed it from its vendor list on October 8. Beeswax removed the company, Vungle paused access pending review, and Eskimi blocked accounts and associated domains. Eskimi separately says its last related campaign stopped on August 6. These actions cut identified buying routes on the respective platforms.

The underlying abilities to deliver code with advertisements and select content by device remain. Newsrooms and other high-risk organizations have reason to apply advertising and tracking blocks on both managed devices and network gateways, including in-app advertising. Blocking can disrupt normal page rendering or app functions, so critical workflows need testing on managed devices. Gateway rules based only on domains or IP addresses cannot distinguish individual paths within a shared domain. Restricting advertising IDs and third-party tracking reduces identification signals. Keeping browsers and operating systems updated reduces the known vulnerabilities available to later payloads.

For existing connections, start with the specific domains and sequences in the investigations. Preserve request times, device identity, browser or app, subsequent destinations and host events. Do not revisit a suspect advertisement or request its scripts to check it, and do not block an entire shared platform such as CloudFront. Ordinary ad contact helps narrow the investigation. If validation-server contact, command traffic or host anomalies appear, preserve evidence from the relevant devices and restrict their access. Revoke sessions that may have been exposed and investigate the information those devices could access at the time.

Publishers have a nearer question too: did they place advertising scripts in the same-origin environment as their login page? Isolating advertisements, limiting controlled sharing and protecting session cookies address the second data path in this report, which needs no system exploit. Verify normal rendering and login flows with controlled, trusted test creatives. A checked configuration box cannot show which cross-origin read the browser rejected or whether a sensitive value stayed where it belonged.

A user can choose not to click. Inspecting every script a page retrieves on their behalf is a very different burden. Publishers need to limit advertising scripts' access to account data, while managed devices and gateways limit further delivery. These protections need to apply when the advertisement loads automatically. By the time someone warns the user about a suspicious banner, the earlier requests may already have left the device.