Citizen Lab: Discover-Tech 'AdFection' ad network delivered Candiru zero-click spyware to Al Jazeera devices
Citizen Lab reported the first publicly confirmed zero-click mercenary spyware attack delivered through targeted online ads, a technique it calls "AdFection". The Israel-based adtech firm Discover-Tech allegedly acts as a front and middleman between the advertising ecosystem and spyware vendors. Citizen Lab traced attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru (now Integrity Labs) spyware delivered through Discover-Tech ads. Google had listed Discover-Tech as an approved vendor since 2020, as had IAB Europe. Google has since cut its access, and IAB Europe, Beeswax, Vungle and Eskimi also took action.
Technical Details
- Discover-Tech's Controlium platform abuses the real-time bidding (RTB) system, which shares device and location data with bidders, to identify specific targets and serve them malicious ads.
- Simply opening a website or app can trigger the attack, with no click or download required.
- Citizen Lab analysed nearly four billion bid records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026.
- Some ads reached networks of government agencies, defense organizations and NATO. There is no evidence these were infected, but the ads could have been used to profile devices.
- Millions of devices were covertly directed to Candiru-associated servers, which does not necessarily indicate infection.
- Discover-Tech and Candiru did not respond to requests for comment.
Remediation
The article gives no defender-side remediation. Platform-level actions so far are the termination of Discover-Tech's access to ad exchanges and its removal from approved vendor lists.
Linha do tempo
-
Citizen Lab: Discover-Tech 'AdFection' ad network delivered Candiru zero-click spyware to Al Jazeera devices
ler a análise desta fonte ocultar
Citizen Lab reported the first publicly confirmed zero-click mercenary spyware attack delivered through targeted online ads, a technique it calls "AdFection". The Israel-based adtech firm Discover-Tech allegedly acts as a front and middleman between the advertising ecosystem and spyware vendors. Citizen Lab traced attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru (now Integrity Labs) spyware delivered through Discover-Tech ads. Google had listed Discover-Tech as an approved vendor since 2020, as had IAB Europe. Google has since cut its access, and IAB Europe, Beeswax, Vungle and Eskimi also took action.
Technical Details
- Discover-Tech's Controlium platform abuses the real-time bidding (RTB) system, which shares device and location data with bidders, to identify specific targets and serve them malicious ads.
- Simply opening a website or app can trigger the attack, with no click or download required.
- Citizen Lab analysed nearly four billion bid records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026.
- Some ads reached networks of government agencies, defense organizations and NATO. There is no evidence these were infected, but the ads could have been used to profile devices.
- Millions of devices were covertly directed to Candiru-associated servers, which does not necessarily indicate infection.
- Discover-Tech and Candiru did not respond to requests for comment.
Remediation
The article gives no defender-side remediation. Platform-level actions so far are the termination of Discover-Tech's access to ad exchanges and its removal from approved vendor lists.