Citizen Lab has uncovered targeted advertising campaigns that infected devices at Al Jazeera with Candiru spyware without requiring users to click anything.
The researchers call the technique “AdFection” and describe their findings as the first public technical confirmation of mercenary spyware delivered through targeted ads.
The investigation identifies Israeli advertising company Discover-Tech as the intermediary connecting spyware operators to mainstream advertising infrastructure.
At least 45 devices within Al Jazeera were targeted during attacks in 2024 and 2025. Network logs the broadcaster provided showed compromised devices contacting Discover-Tech infrastructure, then Candiru validation servers, and then command-and-control servers.
Discover-Tech presents itself as an advertising technology provider and operates an ad-buying platform called MyDSP. Citizen Lab found that its separate Controlium platform allowed customers to select individuals for profiling or infection using mobile advertising identifiers, browser cookie identifiers, and IP addresses.
Candiru, now operating under the Integrity Labs brand, is an Israeli-founded mercenary spyware vendor previously linked to attacks against journalists, activists, and political figures.
From ad impression to spyware infection
The attack begins when Discover-Tech wins an automated auction to place an ad on a website or in an app open on the target’s device.
When rendered, the ad requests JavaScript from a Discover-Tech server. That server returns code based on the visitor’s identifiers and apparent eligibility, directing selected devices to spyware infrastructure. No interaction with the advertisement is required, and some ads may render in the background.
Citizen Lab
This selective delivery also helps conceal malicious activity from advertising security scanners. Most visitors receive no additional JavaScript, while chosen targets can receive the next stage of the attack.
Citizen Lab
Al Jazeera recovered a Windows DLL from a compromised device that contained hardcoded command-and-control addresses. Citizen Lab attributed it to Candiru with high confidence based on infrastructure fingerprints and distinctive similarities to spyware recovered in 2021, including its persistence mechanism and string obfuscation.
Hundreds of millions of ad placements
The researchers examined nearly four billion publicly exposed bidding records covering March through June 2026. Discover-Tech’s MyDSP submitted approximately 3.77 billion bids and appeared to win nearly 442 million auctions.
Ads assessed as containing Discover-Tech’s remote script loaders appeared across 75,373 Android and iOS apps and 120,768 websites. These included messaging, weather, health, dating, and gaming services, as well as major news publications.
Citizen Lab
Impressions also appeared on networks associated with NATO, United Nations bodies, European Union institutions, government agencies, defense companies, and critical infrastructure operators.
An ad impression alone does not establish spyware targeting or infection. Nevertheless, Citizen Lab warned that the reach created opportunities for profiling and potential compromise.
The investigation also linked Discover-Tech to surveillance vendors Bindecy and Intelos. A separate actor, tracked as DARK CARTOGRAPHER, allegedly used its infrastructure to connect advertising identifiers with phone numbers by exploiting mobile-network weaknesses in more than 30 countries.
Advertising platforms cut access
Following the investigation, Google terminated Discover-Tech’s access to its advertising exchanges and deployed Safe Browsing protections against known attacker-controlled domains. IAB Europe removed the company from its vendor registry, Beeswax removed it from its buying platform, Eskimi blocked its accounts and domains, and Vungle paused access pending review.
Discover-Tech and Candiru/Integrity Labs did not respond to Citizen Lab’s requests for comment.
Citizen Lab recommends blocking advertising and tracking at the device and network gateway levels, disabling advertising identifiers where possible, and reviewing advertising-related traffic for suspicious connections. Individuals can reduce exposure through trusted ad blockers and privacy-focused browsers.
Leave a Reply