Citizen Lab exposes AdFection: Discover-Tech ads deliver Candiru zero-click spyware, hitting 45 Al Jazeera devices
The Citizen Lab disclosed AdFection, the first technical demonstration of zero-click mercenary spyware delivered through targeted online advertising. The Israeli firm Discover-Tech presents itself as a legitimate ad company but acts as a facilitator for several mercenary spyware partners, including Candiru. Its ads covertly direct millions of devices to Candiru's servers. Researchers linked, with high confidence, zero-click attacks on at least 45 devices at Al Jazeera to Candiru spyware delivered through these ads. The Citizen Lab cannot currently attribute AdFection to a specific party. Following the research, Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, and IAB Europe removed it from its global vendor list.
Technical Details
- Discover-Tech operates a platform called Controlium that lets its mercenary partners de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered, with no click required.
- Between March and June 2026, Discover-Tech ads were displayed on over 120,000 websites and over 70,000 mobile apps. Confiant, a partner ad security firm, reports the ads also appeared on sensitive networks, including the U.S. Department of Defense, NATO, the IAEA and cybersecurity agencies.
- Candiru spyware can take over a device remotely, steal data and access the microphone and camera.
- Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. It also has connections to the mercenary hacking firm Bindecy and the mercenary ad intelligence firm Intelos.
- A separate actor, DARK CARTOGRAPHER, uses Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers. It links device advertising IDs with phone numbers to mass-deanonymize users. Its activity dates back to 2019, and its infrastructure links to a mercenary adtech vendor and an unnamed U.S. government contractor. A separate Citizen Lab report on it is forthcoming.
- Discover-Tech, Candiru, Bindecy and Intelos did not respond to Citizen Lab's letters.
Remediation
The article gives no technical mitigations. The Citizen Lab calls on regulators and cybersecurity agencies in the U.S., Europe and other regions to investigate Discover-Tech and the companies involved and to impose sanctions. It also calls on the ad industry to address the systemic risks that enable malicious ad targeting.
Linha do tempo
-
Citizen Lab exposes AdFection: Discover-Tech ads deliver Candiru zero-click spyware, hitting 45 Al Jazeera devices
ler a análise desta fonte ocultar
The Citizen Lab disclosed AdFection, the first technical demonstration of zero-click mercenary spyware delivered through targeted online advertising. The Israeli firm Discover-Tech presents itself as a legitimate ad company but acts as a facilitator for several mercenary spyware partners, including Candiru. Its ads covertly direct millions of devices to Candiru's servers. Researchers linked, with high confidence, zero-click attacks on at least 45 devices at Al Jazeera to Candiru spyware delivered through these ads. The Citizen Lab cannot currently attribute AdFection to a specific party. Following the research, Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, and IAB Europe removed it from its global vendor list.
Technical Details
- Discover-Tech operates a platform called Controlium that lets its mercenary partners de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered, with no click required.
- Between March and June 2026, Discover-Tech ads were displayed on over 120,000 websites and over 70,000 mobile apps. Confiant, a partner ad security firm, reports the ads also appeared on sensitive networks, including the U.S. Department of Defense, NATO, the IAEA and cybersecurity agencies.
- Candiru spyware can take over a device remotely, steal data and access the microphone and camera.
- Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. It also has connections to the mercenary hacking firm Bindecy and the mercenary ad intelligence firm Intelos.
- A separate actor, DARK CARTOGRAPHER, uses Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers. It links device advertising IDs with phone numbers to mass-deanonymize users. Its activity dates back to 2019, and its infrastructure links to a mercenary adtech vendor and an unnamed U.S. government contractor. A separate Citizen Lab report on it is forthcoming.
- Discover-Tech, Candiru, Bindecy and Intelos did not respond to Citizen Lab's letters.
Remediation
The article gives no technical mitigations. The Citizen Lab calls on regulators and cybersecurity agencies in the U.S., Europe and other regions to investigate Discover-Tech and the companies involved and to impose sanctions. It also calls on the ad industry to address the systemic risks that enable malicious ad targeting.