Researchers at Citizen Lab have publicly confirmed for the first time that zero-click mercenary spyware can be delivered through targeted online advertisements, a technique they call AdFection.
According to the report, devices at international news network Al Jazeera were infected with spyware from Candiru—rebranded as “Integrity Labs”—via malicious targeted ads. The attack was orchestrated by Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm but allegedly operates as a facilitator for multiple mercenary spyware partners.
Discover-Tech operates a platform called Controlium that enables its partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered. The platform exploits structural vulnerabilities in how online advertising functions. When a user sees an ad, a real-time bidding auction occurs in milliseconds, during which user data—including device identifiers, location, and IP address—flows through multiple intermediaries. Discover-Tech’s system leverages this data ecosystem to target specific individuals and execute zero-click attacks by embedding malicious code within advertisements.
Analysis of four billion Discover-Tech bidding records revealed that during a four-month period, the company’s ads appeared on nearly 200,000 unique websites and Android/iOS apps across dozens of countries. The ads also covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance.
Beyond Candiru, Discover-Tech is linked to other mercenary spyware and intelligence threat actors including Intelos and Bindecy. Researchers also identified a separate threat actor called DARK CARTOGRAPHER using Discover-Tech’s infrastructure to exploit mobile carrier vulnerabilities and mass-deanonymize internet users by linking advertising IDs with phone numbers.
Discover-Tech appeared on Google and IAB Europe’s lists of certified vendors and served ads through major networks including Google, Yandex, and Beeswax. Following disclosure of the findings, Google, IAB Europe, Beeswax, Vungle, and Eskimi disconnected Discover-Tech’s access to the advertising ecosystem. Other ad vendors involved did not respond within the timeline provided.
Key facts
- Devices at Al Jazeera were infected with Candiru spyware via targeted ads purchased by Discover-Tech
- Discover-Tech operates Controlium platform enabling automatic device infection at ad render time
- Four billion bidding records show Discover-Tech ads reached nearly 200,000 unique websites and apps across dozens of countries
- Discover-Tech appeared on Google and IAB Europe certified vendor lists before being disconnected
- A separate threat actor called DARK CARTOGRAPHER is using Discover-Tech infrastructure to mass-deanonymize users