Citizen Lab Exposes AdFection: Discover-Tech Turned Targeted Ads Into a Zero-Click Spyware Pipeline

On 15 October 2026, the University of Toronto's Citizen Lab published a major investigation documenting the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertisements. The researchers named the technique AdFection. They linked it with high confidence to infections of devices at Al Jazeera using spyware from the Israeli firm Candiru (also known as Integrity Labs or Saito Tech).

At the center of the operation is Discover-Tech, an Israeli company that presented itself as a legitimate advertising firm. Citizen Lab assesses that Discover-Tech primarily functioned as a bridge between the digital advertising ecosystem and mercenary spyware vendors.

The Operation at a Glance

How AdFection Works

Modern online ads are not static images. They can execute JavaScript when rendered in a browser or app. Discover-Tech operated a demand-side platform (MyDSP) and a control interface called Controlium. When one of its ads loaded, a script contacted what the company called a NOAS ("getAd") server and submitted advertising identifiers such as a mobile advertising ID or cookie ID, along with other device data.

For ordinary users the server returned an empty response. For selected targets it returned additional code. That code could open an invisible frame pointing to a Candiru validator server, which then directed the device toward an exploit server and ultimately Candiru command-and-control infrastructure. No click or further user interaction was required. The malicious payload never had to be shared with the ad exchanges or publishers that displayed the ad, which helped it evade automated scanners.

Citizen Lab reconstructed this sequence from network logs provided by Al Jazeera. At least 45 devices associated with the broadcaster were targeted in 2024 and 2025. One recovered Windows DLL matched distinctive characteristics of previously documented Candiru chains, including a specific COM-hijacking persistence technique and a repeating 48-byte XOR key.

The delivery chain

• Ad render — A Discover-Tech ad loads in a browser or app and executes JavaScript.
• Beacon — The script contacts a NOAS "getAd" server with an advertising ID or cookie ID plus device data.
• Selective targeting — Ordinary users get an empty response; selected targets receive additional code.
• Pivot — The code opens an invisible frame to a Candiru validator server.
• Staging — The validator redirects the device to an exploit server.
• Access — The device reaches Candiru command-and-control infrastructure, with no user interaction.

Scale of the Operation

Researchers obtained roughly four billion Discover-Tech bidding records covering March to June 2026. In that window the company's ads appeared across approximately 120,000 websites and 75,000 Android and iOS apps in more than 160 countries. Ads were observed on networks linked to international organizations, national governments, media outlets, universities, energy companies, and semiconductor firms.

Discover-Tech's infrastructure also caused millions of devices to contact Candiru-related servers for tracking and reconnaissance even when full infection did not occur. Login records exposed on Controlium infrastructure linked accounts to personnel associated with Candiru/Integrity Labs, the ADINT firm Intelos, and the exploit developer Bindecy. Citizen Lab also identified a separate threat actor, labeled DARK CARTOGRAPHER, that leveraged Discover-Tech infrastructure to help map mobile advertising IDs to phone numbers by exploiting carrier systems; a fuller report on that actor is forthcoming.

Industry Response

Discover-Tech had appeared on certified or approved vendor lists maintained by Google and IAB Europe and had served ads through major platforms including Google, Yandex, Beeswax (Freewheel), Vungle (Liftoff), and Eskimi. After disclosure, Google terminated Discover-Tech's access to its ad exchanges and added Safe Browsing protections for known actor domains. IAB Europe, Beeswax, Vungle, and Eskimi also took action to disconnect or restrict the company. Other vendors contacted by the researchers did not respond within the provided timeline.

Implications

AdFection demonstrates that the real-time bidding and third-party code execution model of online advertising can be turned into a precise, scalable delivery mechanism for mercenary spyware. Because the attack occurs simply when an ad is rendered, traditional user-education defenses and many network-based detection approaches are less effective. The case also shows how a company can maintain a veneer of legitimacy inside major ad networks while primarily serving surveillance clients.

Organizations that handle sensitive work, especially media, civil society, government, and critical-industry entities, should treat unexpected connections to advertising-related infrastructure with elevated scrutiny and maintain strong endpoint visibility for zero-click infection indicators.

Indicators of Compromise

Discover-Tech / Controlium infrastructure (domains)

• discover-tech[.]io
• mtrtb[.]com
• mydsp[.]io
• controlium[.]net
• powerium[.]net
• platc-tester[.]com
• myweb3id[.]io
• myipinfo[.]io
• akedo[.]gg
• volasim[.]com
• tracookiepixel[.]xyz

NOAS / getAd servers

• noas.mtrtb[.]com
• infinoas.mtrtb[.]com
• ppv2.mtrtb[.]com
• pqv2.mtrtb[.]com
• events.platc-tester[.]com
• events.myweb3id[.]io
• noas.powerium[.]net
• qa-noas.powerium[.]net
• noas.adtimizer[.]co
• noas.impchkdsp[.]com
• noas.trakking[.]co

Candiru-linked domains observed in the investigation

• keyadapter[.]com
• sharethere[.]net
• fearevolve[.]com
• jobmarcher[.]com
• insightenterprisells[.]com
• plasticbells[.]com

Candiru spyware sample

SHA256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8

Defenders should monitor for connections to the domains above, especially sequences in which an advertising-related domain is followed within seconds by a Candiru validator or C2 domain. Blocking or tightly controlling third-party ad scripts on high-risk networks remains a practical mitigation while the broader advertising ecosystem addresses these abuse patterns.

The Takeaway

AdFection collapses the distance between a routine ad impression and a nation-grade intrusion. The ad supply chain is now a delivery channel for zero-click spyware, and legitimate-looking intermediaries can sit inside major ad networks while serving surveillance clients. High-risk organizations should inventory and restrict third-party ad code, monitor for ad-to-C2 connection sequences, and assume that render-time is sufficient for compromise.

Sources

• Citizen Lab: Exposing AdFection — How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (15 October 2026)

Turn ad-tech abuse and spyware activity into actionable intelligence with the Threat Landscape Platform — curated threat reports, IoC feeds, and an AI Assistant for instant analysis. Start free, no credit card required, or go Professional from $49/month.