Threat reportMalwareTL-2026-3628
AdFection: Discover-Tech Abuses Real-Time Bidding Ad Networks to Deliver Candiru Spyware
AdFection: Discover-Tech Abuses Real-Time Bidding Ad (TL-2026-3628), also tracked as AdFection, is a high-severity malware campaign, first published 2026-10-15. It is attributed to Caramel Tsunami (Israel) with high confidence, affects Microsoft Windows (Candiru DLL implant; Al Jazeera infections were, maps to 28 MITRE ATT&CK techniques (T1016.001, T1027, T1041), and is covered by 9 detection rules and 63 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 28MITRE ATT&CK
- Actors
- 2Caramel Tsunami
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 63Indicators of compromise
Key facts for TL-2026-3628
- Threat ID
- TL-2026-3628
- Also known as
- AdFection
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Caramel Tsunami, Integrity Labs
- Attribution confidence
- HIGH
- Nation-state nexus
- Israel
- Motivation
- ESPIONAGE
- Target sectors
- news - media, government administration, defense, critical-infrastructure, energy, semi-conductors, international-organizations, civil society
- Target regions
- Middle East, Europe, Nordics, australia, North America
- Detection rules
- 9
- Indicators of compromise
- 63
- Updates
- 2026-10-15 · 5 updates · revalidated 5× · latest source
Malware and tooling in AdFection: Discover-Tech Abuses Real-Time Bidding Ad
Malware and tooling: Controlium
How AdFection: Discover-Tech Abuses Real-Time Bidding Ad works
Citizen Lab (report published 2026-10-15) documents 'AdFection', in which Israeli adtech firm Discover-Tech used real-time bidding (RTB) auctions and its Controlium platform to profile, de-anonymize and select targets, then served ad-delivered JavaScript that installed Candiru (Integrity Labs) spyware with no click or download. At least 45 Al Jazeera Windows devices were infected in 2024-2025.
AdFection is a zero-click delivery technique that turns the programmatic advertising supply chain into a spyware pipeline. Discover-Tech Ltd, an Israeli adtech intermediary approved by Google and IAB Europe since 2020, operates the Controlium platform, which lets mercenary-spyware customers de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered. Citizen Lab analysed roughly four billion Discover-Tech (MyDSP) bid records: between March and June 2026 the DSP placed about 3.77 billion bids and won about 442 million auctions (about 76.7% in mobile apps, 23.3% in web browsers), with ads appearing on nearly 200,000 unique websites and apps across dozens of countries. The principal exchanges were Yandex (67.4%), Google Ad Manager (24.7%) and Vungle (7.2%).
Exploit chain as documented by Citizen Lab: (1) Discover-Tech wins an RTB auction for a chosen device and the ad creative contains a script tag pointing to a Discover-Tech 'NOAS' server (e.g. noas.mtrtb.com/getAd, noas.powerium.net/getAd). (2) The NOAS server receives the advertising ID (IDFA / Android Ad ID), cookie IDs and source IP and evaluates eligibility against a target list. (3) For non-targets the server returns a 0-byte response; for targets it returns JavaScript. (4) That JavaScript loads an exploit chain that installs Candiru spyware. Citizen Lab states the exact zero-click exploit mechanism remains under analysis and no CVE is attributed to AdFection itself; historical Candiru exploits (CVE-2021-21166, CVE-2021-30551, CVE-2021-33742, CVE-2021-31979, CVE-2021-33771) are referenced only as background. Ad URLs carry AES-256-encrypted, Base64 parameters (?q= / ?qq=) containing IP, timestamp, user-agent and ad-ID, and target-selection infrastructure ('Infinite FIFO') routed 3,637,213 'eligible users' between January and June 2026.
The recovered Windows DLL sample (SHA256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) uses COM-hijack persistence with a different DLL from the 2021 variant, a 48-byte repeating XOR key for string obfuscation, hardcoded connectivity checks to www.google.com and www.microsoft.com, and hardcoded C2 domains fearevolve.com and jobmarcher.com. Victim telemetry shows a temporal signature of Discover-Tech NOAS contact, then a Candiru validator server, then Candiru C2. Citizen Lab fingerprinted Candiru validator servers (Fingerprint V1) and C2 servers (Fingerprint C1) and identified 305 validator domains active between August 2022 and July 2026. Controlium also had authentication weaknesses (authorization token derived from unencrypted user metadata rather than a signed Auth0 JWT) and an unauthenticated /csv-download endpoint exposing 128 days of login logs for 120 usernames. Controlium users were linked to other mercenary-spyware and intelligence-tool vendors, including Intelos and Bindecy. Discover-Tech infrastructure was also used by a separate actor, DARK CARTOGRAPHER, for large-scale deanonymization (WebRTC IP leaks, MSISDN header-enrichment flaws) since at least 2019; a separate report is planned.
Impressions were observed on government, defense, critical-infrastructure and international-organization networks (including NATO and UN networks, Nordic government and energy networks, and semiconductor and defense firms). These are profiling observations; infections are confirmed only for Al Jazeera. Google, IAB Europe, Beeswax/FreeWheel, Vungle/Liftoff and Eskimi terminated or paused Discover-Tech access; Google also deployed Safe Browsing protections. Discover-Tech and Candiru/Integrity Labs did not respond to Citizen Lab.
MITRE ATT&CK techniques used in TL-2026-3628
Discovery
T1016.001 Internet Connection Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Collection
Execution
T1059.007 JavaScript; T1203 Exploitation for Client Execution
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding; T1568 Dynamic Resolution; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Initial Access
Credential Access
T1539 Steal Web Session Cookie
Persistence
T1546.015 Component Object Model Hijacking
Resource Development
T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1583.008 Malvertising; T1608.004 Stage Capabilities: Drive-by Target
Reconnaissance
T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information; T1590.005 IP Addresses; T1592 Gather Victim Host Information
Affected products and versions in AdFection: Discover-Tech Abuses Real-Time Bidding Ad
- Microsoft — Windows (Candiru DLL implant; Al Jazeera infections were Windows devices)
Vulnerable versions: Not specified in sources - Multiple — Real-time bidding ad ecosystem (Google Ad Manager, Yandex, Vungle/Liftoff, Beeswax, Eskimi, Xandr, Sunteng) and ad-supported websites and mobile apps
Vulnerable versions: Ads placed March-June 2026 on about 200,000 sites and apps
Fixed in: Discover-Tech access terminated or paused by Google, IAB Europe, Beeswax, Vungle, Eskimi
Remediation for AdFection: Discover-Tech Abuses Real-Time Bidding Ad
Patches
- No CVE is attributed to AdFection; keep browsers, Windows and Office fully patched because earlier Candiru chains used browser and Windows zero-days
Immediate actions
- Block ads and tracking at the network gateway and on endpoints, including DNS/proxy blocking of the Discover-Tech domains listed in the IOCs
- Hunt proxy, DNS and EDR telemetry for contact with Discover-Tech NOAS domains followed by Candiru validator/C2 domains
- Search endpoints for the Candiru DLL SHA256 and for COM-hijack persistence registry changes
- Enforce ad-blocking on government and high-risk user devices
Workarounds
- Restrict JavaScript execution in ad contexts and use browser-level ad isolation
- Use trusted ad-blocking extensions and home-network ad blocking for at-risk individuals such as journalists and activists
Longer-term hardening
- Disable or regularly reset mobile advertising IDs via MDM on managed devices
- Adopt browsers with built-in anti-tracking and ad-blocking
- Monitor for malicious requests linked to advertising impressions
- Advertising industry: mandatory KYC and recurring vetting of DSPs, third-party audits of certified vendors and real-time scanning for conditional payloads
Weaknesses (CWE) in AdFection: Discover-Tech Abuses Real-Time Bidding Ad
Timeline of AdFection: Discover-Tech Abuses Real-Time Bidding Ad
Showing the 20 most recent tracked events.
- Citizen Lab publishes 'Hooking Candiru', documenting the Windows spyware chain that the 2026 sample overlaps.
- U.S. sanctioned Candiru; the 2021 Candiru Windows chain is the baseline Citizen Lab compares the new sample against.
- Earliest of 305 Candiru validator-server domains matching Citizen Lab's V1 fingerprint (activity spans August 2022 to July 2026).
- Start of the 2024-2025 period in which at least 45 Al Jazeera Windows devices were infected with Candiru spyware via Discover-Tech ad delivery.
- New Candiru profiling domains (outdooutcome.com, suggestutterly.com) registered with info@rockhoster.com.
- Domains outdooutcome.com, suggestutterly.com and sincereaccertain.com registered within hours of each other on 2025-03-18; sincereaccertain.com URLs distributed via Discover-Tech ads from April 2025.
- Candiru profiling URLs (sincereaccertain.com, encrypted URLs) begin to be distributed via Discover-Tech ads.
- Candiru acquired by U.S.-based Integrity Partners for $30 million and rebranded Integrity Labs.
- CloudFront distribution d1fcoizt7mje85.cloudfront.net deployed for profiling; it ceased operating in December 2025.
- Confiant observes a secondary payload pattern on 2025-12-02.
- January-June 2026: 3,637,213 'eligible users' routed through Infinite FIFO target tracking via ppv2.mtrtb.com (V3 OpSec evolution).
- March-June 2026: MyDSP placed about 3.77 billion bids and won about 442 million auctions across roughly 200,000 websites and apps.
- Confiant detects an ad creative triggering cloaking heuristics; its observation window runs April 1 - September 10, 2026.
- Controlium authentication logs (128 days, 120 usernames) reviewed in July 2026; the V1 validator fingerprint was retiring May-July 2026.
- Discover-Tech Druid analytics instances (druid.mtrtb.com) shut down.
- Wildcard TLS certificate for *.adtimizer.co issued.
- Early October 2026: Google and IAB Europe removed Discover-Tech from their registries and ad exchange access; Beeswax, Eskimi and Vungle subsequently blocked or paused it.
- Vungle/Liftoff pauses Discover-Tech access (Oct 12); Beeswax removes the company (Oct 13); Eskimi details its findings (Oct 14).
- Confiant publishes parallel 'ADINT' research detailing the Candiru ad-delivered JavaScript SDK, cookie theft and DoH covert channel.
- Citizen Lab publishes the AdFection report; The Register and Engadget report the findings the same day.
Update history for TL-2026-3628
- 2026-10-15 — AdFection: Discover-Tech Controlium ad platform used to deliver zero-click Candiru (Integrity Labs) spyware via targeted online ads: What changed No change to severity (HIGH), exploitability (ACTIVE), status or attribution; the update only adds technical detail. New indicators (3) 1 Bindecy-associated IPv4 (52.174.65.77), 1 Bindecy infrastructure page hash, and the ppv2.
- 2026-10-15 — Candiru Spyware Delivered Zero-Click via Discover-Tech Targeted Ads (AdFection) – Al Jazeera Devices Infected: What changed No severity, exploitability or status change (already HIGH / ACTIVE). Adds Confiant's independent technical analysis of the ad-delivered JavaScript stage that complements Citizen Lab's findings. New indicators (9) 1 new SDK C2
- 2026-10-15 — AdFection: Ad-Delivered Zero-Click Spyware Campaign (Candiru / Integrity Labs via Discover-Tech) Targeting Al Jazeera Devices: What changed No severity, exploitability, status or attribution change; existing values (HIGH / ACTIVE / HIGH-confidence Candiru) already match the newer report. New indicators (3) 3 new domains: events.platc-tester.com, druid.mtrtb.com, dt
- 2026-10-15 — AdFection: Zero-Click Mercenary Spyware (Candiru / Integrity Labs) Delivered via Discover-Tech Targeted Ads and the Controlium Platform: What changed No severity, exploitability, status or attribution change; the existing values already match the newer report. New indicators (9) 9 new indicators: additional Discover-Tech/Controlium hosts (volasim.com subdomains, dtech.adtimi
- 2026-10-15 — AdFection: Discover-Tech Ad Infrastructure Used to Deliver Zero-Click Mercenary Spyware (Candiru) — Citizen Lab: What changed No field changes. Severity HIGH, exploitability ACTIVE, status ACTIVE and attribution are already correct and unchanged. New indicators (9) 9 additional network domains: mtrtb.com, myweb3id.io and adtimizer.co (parent domains),
Sources cited for AdFection: Discover-Tech Abuses Real-Time Bidding Ad
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
- Spyware vendors found a way to make targeted ads even worse - The Register
- CitizenLab details new spyware triggered by online advertising - Engadget
- Citizen Lab Ties Discover-Tech Ad Network to Candiru Spyware - AI Weekly
- Zero-click spyware delivered through targeted ads - Cypro
- Israeli Ad Firm Helped Spyware Target Al Jazeera: Report - Punjab Kesari
- John Scott-Railton thread on AdFection
Detection coverage for TL-2026-3628
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3628 across Splunk SPL, Microsoft KQL and Sigma, covering 63 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.