/
← Voltar ao feed
high media government journalism defense military critical infrastructure

AdFection: Discover-Tech ads delivered Candiru zero-click spyware to at least 45 Al Jazeera devices, Citizen Lab reports

5 fonte(s) · 5 atualização(ões) · publicado 15/10/2026 07:00 · coletado há 1 dia

Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 22/10/2026 00:03; os links antigos trazem para cá.

Fontes: wired.com ↗ cyberscoop.com ↗ theregister.com ↗ bleepingcomputer.com ↗ thehackernews.com ↗

The Citizen Lab disclosed AdFection on 15 October 2026. It calls this the first public technical confirmation of zero-click mercenary spyware delivered to real devices through targeted online advertising. The Israeli ad firm Discover-Tech (spelled Discovere-Tech by bleepingcomputer.com) posed as a legitimate ad company while acting as a bridge between the advertising ecosystem and spyware vendors, including Candiru. Citizen Lab attributes with high confidence attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through these ads (thehackernews.com, bleepingcomputer.com). It has not named the government customer behind the operation (thehackernews.com), and cyberscoop.com says it cannot currently attribute AdFection to a specific party. After being notified, Google cut Discover-Tech's access, and IAB Europe, Beeswax, Vungle and Eskimi also took action. The Citizen Lab is urging regulators to investigate and sanction the companies involved.

Detalhes técnicos

  • Discover-Tech's Controlium platform lets partners de-anonymize, fingerprint and automatically infect devices when an ad renders, with no click required (cyberscoop.com, wired.com). It abuses real-time bidding (RTB), which shares device and location data with bidders, to pick targets. Victims may see no ad at all (wired.com, theregister.com).
  • Mechanism (thehackernews.com, bleepingcomputer.com): Discover-Tech bought placements through mainstream ad networks and exchanges. Each ad carried a small JavaScript callback that sent the advertising ID and IP address to Discover-Tech's NOAS server (also called the "getAd server"). The server decided whether the device was a target. Targets received attack code in the browser or app, and everyone else received nothing. The ads themselves carried no malicious code, so ad networks had nothing to detect.
  • Al Jazeera network logs showed a consistent sequence on infected devices: a Discover-Tech ad server, then a Candiru screening/validation server, then a spyware command-and-control (C2) server (thehackernews.com, bleepingcomputer.com, wired.com). Al Jazeera supplied the evidence and its logs were key to attributing the ad-based delivery.
  • Researchers recovered the spyware from one device but not the browser or app exploit, so the initial compromise step is inferred from how the attack was set up (thehackernews.com). A Windows DLL recovered from a compromised system shares techniques and infrastructure with Candiru samples, including a tool Citizen Lab analyzed in 2021. This underpins the high-confidence attribution (thehackernews.com, bleepingcomputer.com).
  • Candiru spyware can take over a device remotely, steal data and access the microphone and camera (cyberscoop.com). Candiru also developed the Windows malware DevilsTongue, tied in past reports to Windows and Chrome zero-days used against journalists, activists and politicians (bleepingcomputer.com).
  • Scale between March and June 2026: nearly four billion bid records analysed, specifically 3.77 billion bids and 442 million auctions won on one platform (bleepingcomputer.com). Ads assessed to carry attacker script tags appeared in 75,373 Android/iOS apps and 120,768 websites. Several apps displayed over a million Discover-Tech-linked ads (wired.com). Confiant estimated roughly 10 million ads a day (thehackernews.com). Millions of devices may have been redirected to Candiru-associated servers, which does not by itself indicate infection.
  • Reach: ads appeared on networks of NATO, the UN, EU and European lawmaking bodies, government offices in about two dozen countries, Australian critical infrastructure providers, armed forces and agencies in Norway and Sweden, chipmakers and news organizations. cyberscoop.com, citing Confiant, also lists the U.S. Department of Defense, the IAEA and cybersecurity agencies. There is no evidence these networks were infected. Confiant found the ads it could tie directly to Candiru were low-volume and mostly reached home and mobile connections (thehackernews.com).
  • Background: Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. It has links to the mercenary hacking firm Bindecy and the ad intelligence firm Intelos (cyberscoop.com). Google and IAB Europe had listed it as an approved vendor since 2020 (theregister.com).
  • A separate actor, DARK CARTOGRAPHER, uses Discover-Tech infrastructure to exploit vulnerabilities across numerous mobile carriers. It links advertising IDs to phone numbers to mass-deanonymize users, with activity dating to 2019. Its infrastructure links to a mercenary adtech vendor and an unnamed U.S. government contractor. A separate Citizen Lab report is forthcoming (cyberscoop.com).
  • A similar technique, Aladdin, was documented by Amnesty International in late 2025 delivering Predator (Intellexa) via ads. It was identified from leaked Intellexa documents, whereas AdFection was observed in real attacks (bleepingcomputer.com).
  • Published IOCs (thehackernews.com): SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 (recovered spyware) and the domain mtrtb[.]com (Discover-Tech ad server). Further indicators, including C2 servers, are in Confiant's report.

Remediação

  • Block the published indicators and search logs and telemetry for them. Hunt for the sequence of a device contacting a Discover-Tech ad server, then a Candiru screening server, then a C2 server. Organizations whose staff may have seen the ads, especially those on the networks named in the report, should prioritize this review (thehackernews.com).
  • Network-level monitoring helps defenders detect this activity, and researchers call for stricter customer vetting by ad companies (wired.com).
  • Individuals can do little beyond blocking ads as thoroughly as possible on all websites and platforms. Google has enabled Safe Browsing warnings for websites linked to the group (wired.com).
  • Citizen Lab calls on regulators and cybersecurity agencies in the U.S., Europe and elsewhere to investigate and sanction Discover-Tech and the companies involved, and on the ad industry to address the systemic risks that enable malicious ad targeting (cyberscoop.com).

Relatos divergentes

  • Apps affected: about 70,000 (cyberscoop.com, wired.com, theregister.com), about 75,000 (thehackernews.com) and 75,373 (bleepingcomputer.com). The last is the most precise; the website count of about 120,000 (120,768) is consistent across sources.
  • Platform action: cyberscoop.com says Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, and that IAB Europe removed it from its global vendor list. wired.com says Google banned it and IAB Europe suspended it. thehackernews.com dates the removals to early October 2026. The extent of the other platforms' actions is reported differently: wired.com names Beeswax, while theregister.com and bleepingcomputer.com also name Vungle and Eskimi.
  • Attribution and timing: cyberscoop.com says Citizen Lab cannot attribute AdFection to a specific party and gives no year for the 45-device attacks. The other outlets give 2024 and 2025 and a high-confidence Candiru attribution, so the two statements likely refer to the Candiru link versus the ultimate customer.
  • Candiru ownership: theregister.com calls Candiru now Integrity Labs, while wired.com says Integrity Partners is believed to own its assets after the 2021 US sanctions. Neither Integrity entity responded to requests for comment (wired.com). Discover-Tech, Candiru, Bindecy and Intelos did not respond to Citizen Lab's letters (cyberscoop.com).
  • Exposure estimates: wired.com says millions of devices were redirected. bleepingcomputer.com gives hundreds of thousands to millions of users directed to attacker domains, and theregister.com stresses this does not necessarily indicate infection. Not all ads were necessarily weaponized (wired.com).

Linha do tempo

  1. wired.com ↗ · pub. 15/10/2026 07:00 · coletado 20/10 16:31

    AdFection: Candiru spyware delivered via zero-click malicious ads from Discover-Tech hits 45 Al Jazeera devices

    ler a análise desta fonte

    Citizen Lab documented AdFection, a campaign in which the Israeli-founded ad firm Discover-Tech delivered zero-click mercenary spyware attributed to Candiru through the online advertising ecosystem. During 2024 and 2025, 45 devices belonging to Al Jazeera were targeted. Citizen Lab calls this the first detailed public technical evidence of sophisticated spyware infecting devices via digital ads. Discover-Tech's Controlium platform can allegedly de-anonymize, fingerprint and automatically infect devices once an ad appears. Google has banned Discover-Tech, IAB Europe has suspended it from its Global Vendor List, and Beeswax has removed it from its platform.

    Technical Details

    • Infected Al Jazeera devices contacted Discover-Tech-linked domains and then connected to infrastructure associated with Candiru. Al Jazeera network logs were key to attributing the ad-based delivery.
    • Researchers estimate millions of devices were redirected to Candiru servers where they could be profiled.
    • Ad-bidding records exposed on the Discover-Tech website show ads with attacker script tags in more than 70,000 mobile apps and more than 120,000 websites between March and June 2026. Multiple apps displayed over a million Discover-Tech-linked ads.
    • Not all ads were necessarily weaponized, but Discover-Tech impressions were seen on government and national-security-linked networks, including NATO and United Nations networks, European lawmaking bodies, Australian critical infrastructure providers, and armed forces and government agencies in Norway and Sweden.
    • The attack abuses real-time bidding, which allows individualized content to be pushed to specific users. Victims may not see any ad at all.
    • Integrity Partners, believed to own Candiru's assets after the 2021 US sanctions, did not respond to requests for comment.

    Remediation

    • Citizen Lab says individuals can do little beyond blocking ads as thoroughly as possible on all websites and platforms.
    • Google has enabled Safe Browsing warnings for websites linked to the group.
    • Researchers call for stricter customer vetting by ad companies. Network-level monitoring helps defenders detect such activity.
  2. cyberscoop.com ↗ · pub. 15/10/2026 07:00 · coletado 19/10 17:55

    Citizen Lab exposes AdFection: Discover-Tech ads deliver Candiru zero-click spyware, hitting 45 Al Jazeera devices

    ler a análise desta fonte

    The Citizen Lab disclosed AdFection, the first technical demonstration of zero-click mercenary spyware delivered through targeted online advertising. The Israeli firm Discover-Tech presents itself as a legitimate ad company but acts as a facilitator for several mercenary spyware partners, including Candiru. Its ads covertly direct millions of devices to Candiru's servers. Researchers linked, with high confidence, zero-click attacks on at least 45 devices at Al Jazeera to Candiru spyware delivered through these ads. The Citizen Lab cannot currently attribute AdFection to a specific party. Following the research, Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, and IAB Europe removed it from its global vendor list.

    Technical Details

    • Discover-Tech operates a platform called Controlium that lets its mercenary partners de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered, with no click required.
    • Between March and June 2026, Discover-Tech ads were displayed on over 120,000 websites and over 70,000 mobile apps. Confiant, a partner ad security firm, reports the ads also appeared on sensitive networks, including the U.S. Department of Defense, NATO, the IAEA and cybersecurity agencies.
    • Candiru spyware can take over a device remotely, steal data and access the microphone and camera.
    • Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. It also has connections to the mercenary hacking firm Bindecy and the mercenary ad intelligence firm Intelos.
    • A separate actor, DARK CARTOGRAPHER, uses Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers. It links device advertising IDs with phone numbers to mass-deanonymize users. Its activity dates back to 2019, and its infrastructure links to a mercenary adtech vendor and an unnamed U.S. government contractor. A separate Citizen Lab report on it is forthcoming.
    • Discover-Tech, Candiru, Bindecy and Intelos did not respond to Citizen Lab's letters.

    Remediation

    The article gives no technical mitigations. The Citizen Lab calls on regulators and cybersecurity agencies in the U.S., Europe and other regions to investigate Discover-Tech and the companies involved and to impose sanctions. It also calls on the ad industry to address the systemic risks that enable malicious ad targeting.

  3. theregister.com ↗ · pub. 15/10/2026 11:31 · coletado 19/10 17:54

    Citizen Lab: Discover-Tech 'AdFection' ad network delivered Candiru zero-click spyware to Al Jazeera devices

    ler a análise desta fonte

    Citizen Lab reported the first publicly confirmed zero-click mercenary spyware attack delivered through targeted online ads, a technique it calls "AdFection". The Israel-based adtech firm Discover-Tech allegedly acts as a front and middleman between the advertising ecosystem and spyware vendors. Citizen Lab traced attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru (now Integrity Labs) spyware delivered through Discover-Tech ads. Google had listed Discover-Tech as an approved vendor since 2020, as had IAB Europe. Google has since cut its access, and IAB Europe, Beeswax, Vungle and Eskimi also took action.

    Technical Details

    • Discover-Tech's Controlium platform abuses the real-time bidding (RTB) system, which shares device and location data with bidders, to identify specific targets and serve them malicious ads.
    • Simply opening a website or app can trigger the attack, with no click or download required.
    • Citizen Lab analysed nearly four billion bid records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026.
    • Some ads reached networks of government agencies, defense organizations and NATO. There is no evidence these were infected, but the ads could have been used to profile devices.
    • Millions of devices were covertly directed to Candiru-associated servers, which does not necessarily indicate infection.
    • Discover-Tech and Candiru did not respond to requests for comment.

    Remediation

    The article gives no defender-side remediation. Platform-level actions so far are the termination of Discover-Tech's access to ad exchanges and its removal from approved vendor lists.

  4. bleepingcomputer.com ↗ · pub. 16/10/2026 14:20 · coletado 19/10 17:53

    Candiru spyware delivered to Al Jazeera devices via malicious targeted ads in zero-click 'AdFection' attacks

    ler a análise desta fonte

    Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of mercenary spyware delivered through targeted ads. The activity is linked to the Israeli firm Discovere-Tech (also written Discover-Tech), described as a bridge between mercenary spyware vendors and the advertising ecosystem. Al Jazeera supplied evidence of attacks against at least 45 devices between 2024 and 2025. After Citizen Lab's reports, Google, IAB Europe, Beeswax, Eskimi and Vungle removed offending accounts and blocked access to domains.

    Technical Details

    • Discover-Tech's Controlium platform let customers target specific devices with malicious code, or profile, deanonymize and fingerprint devices.
    • The company bought ad placements through mainstream ad networks and exchanges and embedded JavaScript in the ads. When rendered, the ads contacted its NOAS server (also called the "getAd server").
    • The server used parameters such as IP address and ad identifiers to decide whether a device was eligible. Selected targets received additional code and all other devices received nothing, which kept the operation stealthy.
    • Network logs showed a sequence from Discover-Tech infrastructure to Candiru validation servers and then to spyware command-and-control servers.
    • Researchers recovered a DLL from a compromised Windows system and attributed it to Candiru with high confidence, based on infrastructure and code overlaps with previously captured samples.
    • Candiru also developed the Windows malware DevilsTongue, which can steal files, credentials and messages. Past reports tie its tools to Windows and Chrome zero-day exploits used against journalists, activists and politicians.
    • Scale of the ad operation between March and June 2026: 3.77 billion bids and 442 million auctions won. Ads assessed to carry attacker script tags appeared across 75,373 Android/iOS apps and 120,768 websites. These figures are not infection counts, but Citizen Lab estimates hundreds of thousands to millions of users were directed to the attacker domains.
    • A similar technique, Aladdin, was documented by Amnesty International in late 2025 delivering Predator (Intellexa) via ads. It was identified from leaked Intellexa documents, whereas AdFection was observed in real attacks.

    Remediation

    The article gives no defender-side guidance beyond the takedowns. The ad networks named above removed the offending accounts and blocked the domains after receiving Citizen Lab's reports.

  5. thehackernews.com ↗ · pub. 15/10/2026 13:01 · coletado 19/10 17:53 primeiro registro

    Citizen Lab links Candiru zero-click spyware infections at Al Jazeera to malicious ads served via Discover-Tech

    ler a análise desta fonte

    Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and Citizen Lab attributes the activity to Candiru with high confidence. It did not name the government customer behind the operation. The ads were placed by Discover-Tech, an Israeli firm posing as a legitimate ad company. Google, IAB Europe and several ad platforms removed it in early October 2026 after being notified.

    Technical Details

    • Each ad carried a small callback script that sent the device's advertising ID and IP address to a Discover-Tech server. The script ran as soon as the ad loaded, sometimes in the background.
    • That server decided whether the device was a target. For targets it returned attack code to the browser or app; for non-targets it returned nothing. Because the ads carried no malicious code, ad networks had nothing to detect.
    • Al Jazeera traffic logs showed a consistent sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server running the spyware.
    • Researchers recovered the spyware from one device but not the browser or app exploit. The initial compromise step is inferred from how the attack was set up, not from captured code.
    • A Windows program file pulled from a compromised device shares distinctive techniques with a Candiru tool Citizen Lab analyzed in 2021, which underpins the high-confidence attribution.
    • Scale: nearly four billion ad bids on one platform between March and June 2026. Ads with the callback code appeared in about 75,000 apps and 120,000 websites. Confiant estimated roughly 10 million ads a day.
    • Ads appeared on networks of NATO, the UN, EU bodies, government offices in about two dozen countries, chipmakers and news organizations. This shows reach, not proof of infection. Confiant found the ads it could tie directly to Candiru were low-volume and mostly reached home and mobile connections.
    • Published IOCs include SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 (recovered spyware) and the domain mtrtb[.]com (Discover-Tech ad server). Further indicators, including C2 servers, are in Confiant's report.

    Remediation

    • Block the published indicators and search logs and telemetry for them.
    • Hunt for the connection sequence: a device contacting a Discover-Tech ad server, then a Candiru screening server, then a C2 server.
    • Organizations whose staff may have seen the ads, especially those on the networks named in the report, should prioritize this review.