Glonce

Citizen Lab exposes AdFection: Candiru spyware delivered via targeted ads

securityThe Glonce editorsHacker News🔥82Glonce rating82Impact75Novelty85Relevance75Surprise85Players40Credibility85
Citizen Lab exposes AdFection: Candiru spyware delivered via targeted ads

Citizen Lab has published a report it describes as the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. It calls the technique AdFection. According to the report, devices at the international news network Al Jazeera were infected with spyware from Candiru, which has rebranded as "Integrity Labs", simply by being shown a targeted ad.

The ads were bought by Discover-Tech, an Israel-based company that presents itself as a legitimate advertising firm. Citizen Lab says it found that the company instead operates as a facilitator for several mercenary spyware partners, and that it "appears to be a front" for large-scale ad espionage abuse. The report adds that serving as a bridge between ad vendors and the spyware industry appears to be Discover-Tech's primary purpose.

How it works, as the report explains it: when someone sees an ad in an app or on a website, it is usually the result of a real-time bidding auction, and these auctions happen hundreds of billions of times a day. Bid requests carry granular data such as device identifiers, precise location and IP address, so the system can target a single person by mobile advertising ID, cookie ID or IP address. Ads can also carry code that runs in the app or browser. Citizen Lab says this architecture is abused: the code an ad fetches can be a chain of JavaScript, ending in a browser exploit that installs spyware, and it can be sent to exactly one target. The simple display of a targeted ad is enough for infection.

Discover-Tech's platform for this is called Controlium. Citizen Lab says it lets mercenary partners de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered. Discover-Tech places ads through a platform called MyDSP, which interfaces with Google, Yandex, Vungle (Liftoff) and Sunteng, and separately buys ads through Eskimi and Comcast-owned Beeswax (Freewheel). Many of its ads contain a script tag that points to what the company calls a "NOAS server" (also called a "getAd server"). The rendered ad connects back to that server and submits the user's advertising identifiers, either a cookie ID or a mobile ad ID, then runs whatever JavaScript comes back. The server decides, apparently from the source IP address and the advertising identifiers, whether the target is eligible. If not, it returns a 0-byte response. This lets Discover-Tech avoid sharing malicious code, or even pointers to it, with the companies that serve and display the ads.

The scale is large. Citizen Lab analysed four billion Discover-Tech bidding records and found that over a four-month period the company's ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries. The ads also covertly directed millions of devices to contact Candiru's servers, which Citizen Lab says was likely for large-scale tracking and reconnaissance. The report links Discover-Tech to other players too: Bindecy, another mercenary hacking company, and Intelos, a mercenary ADINT (ad intelligence) firm. A separate threat actor that Citizen Lab calls DARK CARTOGRAPHER is using Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers and link advertising IDs with phone numbers, mass-deanonymizing internet users. That will be detailed in a separate forthcoming report.

The report also describes the people around the company. Dekel Boni is CEO and has a background in digital advertising. Eric Banoun, whom Haaretz describes as "one of the pioneers of offensive cyber in Israel", joined the board soon after the company was founded in 2020 and stayed until 2025. Between 2020 and March 2026, Discover-Tech's shareholders included a company linked to Sara Hamou, who has managed the corporate network of the spyware group Intellexa.

Discover-Tech also looked legitimate to the ad industry. It appeared on lists of "certified" and "approved" vendors kept by Google and the trade body IAB Europe from 2020 until 2026, and it used the EU's GDPR consent frameworks to target users in the European Union. Citizen Lab argues that this shows structural flaws in online advertising, which failed to detect or prevent the abuse.

After Citizen Lab disclosed its findings to ad vendors and industry organizations, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to disconnect Discover-Tech from the digital advertising ecosystem. Other vendors involved did not respond within the timeline provided. Citizen Lab is also working with vendors to mitigate DARK CARTOGRAPHER's attack. It calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws, and makes recommendations to lawmakers, defenders and the advertising industry. The report is co-timed with an investigation by Confiant.

Key facts

  • Citizen Lab says Al Jazeera devices were infected with Candiru (rebranded Integrity Labs) spyware via targeted online ads, a zero-click technique it calls AdFection.
  • The ads were bought by Israel-based Discover-Tech, whose Controlium platform lets mercenary partners de-anonymize, fingerprint and infect devices the moment an ad is rendered.
  • Analysis of four billion bidding records showed Discover-Tech ads on almost 200,000 unique sites and apps in dozens of countries over four months, and millions of devices directed to contact Candiru's servers.
  • Discover-Tech was on Google and IAB Europe lists of certified and approved vendors from 2020 until 2026; after disclosure, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi cut its access.
  • Citizen Lab calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs broke applicable laws; the report is co-timed with a Confiant investigation.

Why it matters

Zero-click spyware usually means a hidden exploit sent to a phone. Citizen Lab says it has now shown a different delivery route: the ad that appears in an ordinary app or web page. It calls this the first public technical confirmation of zero-click mercenary spyware delivered via targeted advertising. The report argues the problem is structural, because the same auction system that targets ads at one person can target code at one person. It also notes that the way spyware vendors plug into the ad ecosystem had remained largely secret until now.

Who it affects

Directly, the people targeted: the report documents Al Jazeera devices infected with Candiru spyware. More widely, the millions of devices that Discover-Tech's ads directed to contact Candiru's servers, and the users profiled across almost 200,000 sites and apps in dozens of countries. EU users are named too, since Discover-Tech used GDPR consent frameworks to target them. The ad vendors in the chain (Google, Yandex, Vungle (Liftoff), Sunteng, Eskimi, Beeswax) and the trade body IAB Europe are affected because their listings and platforms helped the company look legitimate. Through DARK CARTOGRAPHER, anyone whose advertising ID could be linked to a phone number on a vulnerable mobile carrier is also at risk.

How to use it

This is a research report, not a product. Citizen Lab says it makes recommendations to lawmakers, defenders and the advertising industry on how to stop AdFection-style attacks, collected in section 11 of the full report. It also says it is working with vendors to mitigate DARK CARTOGRAPHER's mass-deanonymization attack. Security teams and ad-platform trust and safety staff can read the report's sections on the NOAS server behaviour and the ad deployment techniques for detection ideas.

How solid is it

The primary source is Citizen Lab itself, and it says it presents technical evidence, including analysis of four billion bidding records. The report is co-timed with a separate investigation by Confiant, and five ad vendors acted against Discover-Tech after disclosure. Some of the language is hedged by the authors: Discover-Tech "appears to be" a front, serving as a bridge "appears" to be its primary purpose, and the contacts to Candiru's servers were "likely" for tracking and reconnaissance. The visible text does not report any response from Discover-Tech, Candiru or Al Jazeera. It also does not say when the Al Jazeera infections occurred or how many devices or people were affected, which devices or exploits were involved, or who ordered the attack.

Risks and caveats

The report's conclusions are Citizen Lab's, and some are stated cautiously rather than as established fact. Details of DARK CARTOGRAPHER are deferred to a separate forthcoming report. Other ad vendors involved did not respond within the timeline provided, so the full set of companies that carried Discover-Tech ads is not settled. Citizen Lab only asks regulators to investigate whether laws were violated; it does not assert a legal finding. The NOAS design also means malicious code is delivered only to eligible targets, with a 0-byte response for everyone else, which makes such activity hard for ad vendors to spot.

“We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection.”

— Citizen Lab report