Securify

The online advertising ecosystem — the invisible machinery that decides which banner or video ad loads on your screen — has been quietly weaponized to deliver nation-state spyware. A landmark investigation published on October 15 by Citizen Lab at the University of Toronto reveals that an Israeli advertising firm served as the bridge between the commercial ad industry and Candiru, one of the world’s most notorious mercenary spyware vendors. The result: at least 45 devices at Al Jazeera were silently compromised without a single click from their users.

Citizen Lab is calling the technique “AdFection,” and it represents the first public, technical confirmation that mercenary spyware has reached real devices through targeted online advertising. The implications stretch far beyond one newsroom.

How AdFection Works

The attack chain is deceptively simple and almost impossible for traditional ad-security scanners to catch. The Israeli firm at the center of the operation, Discover-Tech, presents itself as a legitimate advertising company. It was registered in 2020 and, until early October 2026, was listed as an approved vendor by both Google and IAB Europe — the industry body that sets standards for digital advertising across the continent.

Discover-Tech operates a platform called Controlium that lets its partners — including spyware operators — select individuals for profiling or infection using mobile advertising IDs, browser cookie IDs, and IP addresses. In practice, the attack unfolds like this:

1. Discover-Tech wins a standard real-time bidding auction to place an ad on a website or inside an app the target is using.
2. When the ad renders, it requests a JavaScript snippet from a Discover-Tech server.
3. That server checks whether the visitor’s device identifiers match a target list. For the vast majority of people, nothing happens — no malicious code is returned, and the ad behaves normally.
4. If the device belongs to a target, the server delivers attack code that silently redirects the browser or app to Candiru’s spyware infrastructure. Some of these ads load entirely in the background, out of sight.

Network logs recovered from Al Jazeera showed a consistent three-hop sequence on compromised devices: traffic first hit Discover-Tech’s ad server, then a Candiru screening server, and finally a command-and-control node. Because the ad itself carries no malicious payload — the attack code is served conditionally, only to selected targets — ad networks had nothing overtly harmful to flag.

The Scale of Exposure

Citizen Lab examined nearly four billion bidding records from March to June 2026 alone. In that window, Discover-Tech’s MyDSP ad-buying platform submitted roughly 3.77 billion bids and won approximately 442 million auctions. Ads carrying its remote script loaders appeared across more than 75,000 Android and iOS apps and over 120,000 websites, spanning messaging, weather, health, dating, gaming, and major news services.

Partner investigators at the ad-security firm Confiant estimated the operation was serving roughly 10 million ad impressions per day. More troublingly, those impressions appeared on networks belonging to NATO, the United Nations, EU institutions, the U.S. Department of Defense, government agencies in roughly two dozen countries, defense contractors, chipmakers, and critical infrastructure operators. Citizen Lab is careful to note that an ad impression alone does not prove spyware targeting or infection — but it does prove opportunity.

Attribution to Candiru

Researchers recovered a Windows DLL from a compromised Al Jazeera device with hardcoded command-and-control addresses. Citizen Lab attributed the malware to Candiru with high confidence, based on infrastructure fingerprints, persistence mechanisms, and string obfuscation techniques that matched a Candiru tool the lab analyzed in 2021. At least 45 devices at the news network were targeted across 2024 and 2025, though the government behind the operation has not been publicly named.

Candiru, which was placed on a U.S. trade blacklist in 2021, has reportedly restructured. Its assets were acquired by Integrity Partners and moved to a new entity, Integrity Labs, which current sanctions do not cover. Despite the rebrand, the spyware’s technical DNA remains identifiable.

A Deeper Web of Surveillance

The investigation also linked Discover-Tech to other mercenary intelligence firms: Bindecy, described as a mercenary hacking outfit, and Intelos, a mercenary ad-intelligence firm. A separate threat actor dubbed DARK CARTOGRAPHER was found using Discover-Tech’s infrastructure to exploit vulnerabilities across mobile carriers, linking advertising IDs to phone numbers in more than 30 countries. Citizen Lab says it will publish a dedicated report on DARK CARTOGRAPHER separately.

Confiant’s CTO observed that the ad-security industry has historically focused on fighting scams and malware deployed for profit — not surveillance. AdFection represents a fundamentally different adversary: a patient, well-resourced operator content to blend into legitimate ad traffic for months or years, activating only against a small handful of high-value targets.

Industry Response

Once Citizen Lab shared its findings, the response from ad platforms was swift. Google terminated Discover-Tech’s access to its ad exchanges, removed it from its vendor registries, and applied Safe Browsing protections to known attacker-controlled domains. IAB Europe pulled the company from its global vendor list. Beeswax (owned by Comcast) removed Discover-Tech from its buying platform, Eskimi blocked its accounts and domains, and Vungle paused its access pending review.

Neither Discover-Tech, Candiru, Bindecy, nor Intelos responded to Citizen Lab’s requests for comment.

What You Can Do

AdFection is a wake-up call for anyone who assumed that online advertising was merely annoying, not dangerous. Here are practical steps to reduce exposure:

• Use a reputable ad blocker. By preventing ads from loading in the first place, you eliminate the delivery vector entirely. Extensions like uBlock Origin remain among the most effective options.
• Disable or reset your advertising identifier. On iOS, go to Settings → Privacy & Security → Tracking and turn off “Allow Apps to Request to Track.” On Android, navigate to Settings → Privacy → Ads and delete or reset your advertising ID. This makes it harder for an operator to pre-select your device.
• Use a privacy-focused browser. Browsers like Firefox with strict tracking protection, or Brave, limit the data available to ad networks and reduce the fingerprinting surface.
• For organizations: Review ad-related traffic at the network gateway level. Look for the Discover-Tech ad server domain (mtrtb[.]com) and the indicators of compromise published in Confiant’s companion report. Consider DNS-level ad blocking across corporate networks.
• Keep devices and browsers updated. While the initial browser or app exploit used in this campaign has not been publicly detailed, zero-click attacks almost always rely on unpatched vulnerabilities.

What to Watch Next

Citizen Lab has urged regulators to investigate Discover-Tech and impose sanctions. The broader question is whether the programmatic advertising industry — built on speed, automation, and minimal human oversight — can be reformed to prevent this kind of abuse. The fact that a spyware facilitator operated as an approved Google and IAB vendor for six years without detection suggests the current vetting model is fundamentally inadequate.

The upcoming DARK CARTOGRAPHER report promises to reveal even more about how surveillance operators exploit the ad-tech stack. For now, the lesson is stark: the same infrastructure that decides whether you see an ad for running shoes or a streaming service can, in the wrong hands, decide whether your phone gets silently owned.