AdFection: How Mercenary Spyware Invades Victims' Devices Through Targeted Advertising

AdFection: How Mercenary Spyware Invades Victims' Devices Through Targeted Advertising

Researchers at The Citizen Lab (University of Toronto), working with ad-security firm Confiant, published a joint investigation on October 15, 2026 exposing a technique they call AdFection — a zero-click spyware delivery mechanism hidden inside the real-time bidding infrastructure that powers ordinary online advertising. The report names Discover-Tech, an Israel-registered ad-tech company, as the facilitator that quietly channeled mercenary spyware to targeted devices through a platform called Controlium, which the researchers say can "de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered" — with no click, tap, or other user interaction required.

The investigation ties Discover-Tech's infrastructure to known mercenary spyware operators, most notably Candiru (also operating under the name Integrity Labs), as well as the hacking vendor Bindecy and the ad-intelligence firm Intelos. Citizen Lab documented at least 45 compromised devices belonging to journalists and staff at Al Jazeera, and found that Discover-Tech's ad inventory reached far beyond that single newsroom — appearing on sensitive government and defense networks around the world.

Incident Details

How It Worked

The ad-tech pipeline as a delivery channel

Unlike traditional spyware infections that rely on malicious links, infected attachments, or exploited messaging apps, AdFection abuses the real-time bidding (RTB) ecosystem that serves billions of banner, video, and in-app ads every day. Discover-Tech bought and placed what looked like ordinary advertising inventory across a vast network of publishers and mobile apps. Buried inside some of those ad creatives was a callback that reached out to what Citizen Lab calls a "NOAS server," passing along the viewing device's cookie ID or mobile advertising ID the instant the ad rendered on the page or in the app.

Selective, near-invisible targeting

The NOAS server checked the submitted identifier and the requesting device's IP address against a target list. If the device matched a designated target, the server returned malicious JavaScript that executed automatically in the ad's rendering context — no click required. If it did not match, the server silently returned a zero-byte response, making the vast majority of ad impressions behave exactly like normal advertising. Researchers say this selectivity is what allowed the scheme to operate undetected for years: publishers, ad exchanges, and even most security tooling saw nothing unusual because only a tiny fraction of specifically targeted devices ever received the payload.

Controlium: the mercenary control panel

Behind the scenes, Discover-Tech's Controlium platform gave its surveillance-industry customers a dashboard to upload target lists by mobile ad ID, cookie ID, or IP address, select the type of payload to serve, and track which targets had been reached by live ad impressions. Citizen Lab links this infrastructure directly to Candiru spyware found on Al Jazeera devices, with capabilities consistent with Candiru's known toolset: remote device takeover, message and email exfiltration, and activation of device microphones and cameras.

Beyond newsrooms: reaching sensitive networks

Confiant's advertising telemetry showed Discover-Tech ads were not confined to media targets. During the four-month window analyzed, Discover-Tech inventory was observed reaching devices connected to the U.S. Department of Defense, NATO, the International Atomic Energy Agency, and cybersecurity and government agencies in dozens of countries — a reflection of just how deeply RTB ad networks penetrate both consumer and institutional devices.

Impact Assessment

Recommendations

For advertising platforms and ad exchanges

• Audit all third-party demand partners for behavior consistent with selective payload delivery, including identifier-based callback servers and conditional zero-byte responses.
• Strengthen vetting of "certified" vendor status; a vendor's multi-year certification history is not proof of legitimacy, as the Discover-Tech case demonstrates.
• Expand supply-chain auditing of real-time bidding partners, particularly those operating in jurisdictions with established mercenary spyware industries.
• Share threat intelligence with Citizen Lab, Confiant, and peer ad-security researchers to help identify similar facilitator infrastructure before it scales.

For enterprise and government security teams

• Treat ad-blocking and script-isolation controls on managed devices as a baseline control, not an optional hardening step, particularly for high-risk personnel such as journalists, diplomats, and defense staff.
• Monitor outbound traffic for connections to unfamiliar ad-tech identifier-collection endpoints, and flag devices making repeated unexplained callouts tied to advertising SDKs.
• Work with mobile device management tooling to restrict advertising ID exposure and limit in-app ad SDK permissions on devices handling sensitive work.
• Review incident response playbooks to include ad-tech-based delivery as a recognized infection vector, distinct from phishing or exploited messaging apps.

For journalists, activists, and other high-risk individuals

• Assume that visiting any ad-supported website or using any ad-supported app carries some risk of device fingerprinting, and use ad-blocking browser extensions or dedicated secure browsing profiles where possible.
• Request a Citizen Lab or equivalent digital-security-lab device check if there is reason to believe you may have been specifically targeted.
• Keep devices updated and reboot regularly, since some mercenary spyware implants, including those historically linked to Candiru, do not always survive a reboot without reinfection.
• Separate high-risk browsing and communications onto dedicated devices where feasible to limit the blast radius of a single infection.

Key Takeaways

1. AdFection shows that mercenary spyware no longer needs a malicious link or attachment — ordinary real-time bidding ad delivery can itself be the infection vector, with zero user interaction required.
2. Discover-Tech, an Israeli ad-tech company certified by major ad platforms since 2020, operated the Controlium platform that let surveillance customers target, fingerprint, and infect specific devices the moment an ad rendered.
3. The scheme is tied to known mercenary spyware vendors, including Candiru, Bindecy, and Intelos, with at least 45 Al Jazeera devices confirmed infected with Candiru spyware.
4. A selective "zero-byte response" design meant only designated targets ever received malicious code, letting the operation hide in plain sight across more than 120,000 websites and 70,000 mobile apps over a four-month period analyzed by researchers.
5. Discover-Tech's ad inventory reached well beyond journalism targets, touching devices connected to the U.S. Department of Defense, NATO, and the International Atomic Energy Agency.
6. Researchers are urging regulators and lawmakers to investigate and sanction Discover-Tech, and ad platforms including Google and IAB Europe have already removed the company from their vendor registries — but the case raises broader questions about oversight of the entire real-time bidding ecosystem.

Sources

• AdFection: How Mercenary Spyware Invades Victims' Devices Through Targeted Advertising — CyberScoop
• Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — The Citizen Lab
• Zero-click spyware infecting devices through online ads, researchers say — The Record