Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

What it is

AdFection is a Citizen Lab-documented operation in which Israeli ad company Discover-Tech used its Controlium platform to turn ordinary ad delivery into a targeted infection channel for Candiru spyware. Citizen Lab confirmed Candiru as a customer. It says Discover-Tech appears to work with multiple mercenary partners.

How it works

• Discover-Tech buys ads through RTB auctions. The page says ads can carry code that runs in the user's app or browser, normally for tracking impressions and clicks.
• Many of its ads include a script that connects to Discover-Tech infrastructure and submits the device's advertising ID.
• The server then returns JavaScript chosen by a combination of IP address and identifiers. This is how a specific person or device is singled out from millions of ad impressions.
• Controlium covers three stages: de-anonymizing users, fingerprinting devices, and zero-click infection when the ad renders.

flowchart LR
    A[Ad wins RTB auction] --> B[Script calls Discover-Tech server]
    B --> C{IP + ad ID match a target?}
    C -- no --> D[Profiling only]
    C -- yes --> E[Targeted JS served]
    E --> F[Candiru spyware]

Preconditions / Affected

• Exposure comes from an ad being rendered on the device. No click is needed.
• The page gives no OS, browser or version boundaries, and no CVEs.
• Discover-Tech ads appeared across nearly 200,000 websites and Android and iOS apps, so exposure is broad even though confirmed infections were targeted (at least 45 Al Jazeera devices, 2024–2025).
• A related actor, Dark Cartographer, builds databases linking mobile advertising IDs to phone numbers by exploiting vulnerabilities in various mobile carriers. A leaked ad ID can therefore be tied to a real person.

What to do

• Block targeted ads at the gateway. Citizen Lab calls this the most feasible protection for now.
• Prioritize high-risk users such as journalists.
• The recommendation stands until the industry shows it can reliably block all AdFection-style vectors. Treat it as open-ended, not a one-time setting.

Caveats

• Google, IAB Europe, Beeswax and Eskimi cut off Discover-Tech in early October, but Citizen Lab still judges the threat serious enough to keep the gateway recommendation.
• The page gives no detection indicators, domains or IOCs.
• It does not say how the gateway blocking should be implemented.
• It describes Discover-Tech as "likely" a front for a larger spyware campaign, which is an assessment, not a proven fact.