# AdFection: Discover-Tech Abuses Real-Time Bidding Ad Networks to Deliver Candiru Spyware

> Citizen Lab (report published 2026-10-15) documents 'AdFection', in which Israeli adtech firm Discover-Tech used real-time bidding (RTB) auctions and its Controlium platform to profile, de-anonymize and select targets, then served ad-delivered JavaScript that installed Candiru (Integrity Labs) spyware with no click or download. At least 45 Al Jazeera Windows devices were infected in 2024-2025.

- **Published:** 2026-10-15T14:46:21Z
- **Last reviewed:** 2026-10-15T19:32:09.283Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3628
- **ID:** TL-2026-3628
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Caramel Tsunami (Israel)
- **Detections:** 9 · **IOCs:** 63 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AdFection is a zero-click delivery technique that turns the programmatic advertising supply chain into a spyware pipeline. Discover-Tech Ltd, an Israeli adtech intermediary approved by Google and IAB Europe since 2020, operates the Controlium platform, which lets mercenary-spyware customers de-anonymize, fingerprint and automatically infect devices the moment an ad is rendered. Citizen Lab analysed roughly four billion Discover-Tech (MyDSP) bid records: between March and June 2026 the DSP placed about 3.77 billion bids and won about 442 million auctions (about 76.7% in mobile apps, 23.3% in web browsers), with ads appearing on nearly 200,000 unique websites and apps across dozens of countries. The principal exchanges were Yandex (67.4%), Google Ad Manager (24.7%) and Vungle (7.2%).

Exploit chain as documented by Citizen Lab: (1) Discover-Tech wins an RTB auction for a chosen device and the ad creative contains a script tag pointing to a Discover-Tech 'NOAS' server (e.g. noas.mtrtb.com/getAd, noas.powerium.net/getAd). (2) The NOAS server receives the advertising ID (IDFA / Android Ad ID), cookie IDs and source IP and evaluates eligibility against a target list. (3) For non-targets the server returns a 0-byte response; for targets it returns JavaScript. (4) That JavaScript loads an exploit chain that installs Candiru spyware. Citizen Lab states the exact zero-click exploit mechanism remains under analysis and no CVE is attributed to AdFection itself; historical Candiru exploits (CVE-2021-21166, CVE-2021-30551, CVE-2021-33742, CVE-2021-31979, CVE-2021-33771) are referenced only as background. Ad URLs carry AES-256-encrypted, Base64 parameters (?q= / ?qq=) containing IP, timestamp, user-agent and ad-ID, and target-selection infrastructure ('Infinite FIFO') routed 3,637,213 'eligible users' between January and June 2026.

The recovered Windows DLL sample (SHA256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) uses COM-hijack persistence with a different DLL from the 2021 variant, a 48-byte repeating XOR key for string obfuscation, hardcoded connectivity checks to www.google.com and www.microsoft.com, and hardcoded C2 domains fearevolve.com and jobmarcher.com. Victim telemetry shows a temporal signature of Discover-Tech NOAS contact, then a Candiru validator server, then Candiru C2. Citizen Lab fingerprinted Candiru validator servers (Fingerprint V1) and C2 servers (Fingerprint C1) and identified 305 validator domains active between August 2022 and July 2026. Controlium also had authentication weaknesses (authorization token derived from unencrypted user metadata rather than a signed Auth0 JWT) and an unauthenticated /csv-download endpoint exposing 128 days of login logs for 120 usernames. Controlium users were linked to other mercenary-spyware and intelligence-tool vendors, including Intelos and Bindecy. Discover-Tech infrastructure was also used by a separate actor, DARK CARTOGRAPHER, for large-scale deanonymization (WebRTC IP leaks, MSISDN header-enrichment flaws) since at least 2019; a separate report is planned.

Impressions were observed on government, defense, critical-infrastructure and international-organization networks (including NATO and UN networks, Nordic government and energy networks, and semiconductor and defense firms). These are profiling observations; infections are confirmed only for Al Jazeera. Google, IAB Europe, Beeswax/FreeWheel, Vungle/Liftoff and Eskimi terminated or paused Discover-Tech access; Google also deployed Safe Browsing protections. Discover-Tech and Candiru/Integrity Labs did not respond to Citizen Lab.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.008 Malvertising
- T1592 Gather Victim Host Information
- T1590.005 IP Addresses
- T1203 Exploitation for Client Execution
- T1546.015 Component Object Model Hijacking
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1016.001 Internet Connection Discovery
- T1071.001 Web Protocols
- T1589 Gather Victim Identity Information
- T1583.001 Acquire Infrastructure: Domains
- T1608.004 Stage Capabilities: Drive-by Target
- T1189 Drive-by Compromise
- T1590 Gather Victim Network Information
- T1105 Ingress Tool Transfer
- T1583.006 Acquire Infrastructure: Web Services
- T1132.001 Data Encoding: Standard Encoding
- T1059.007 JavaScript
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1056 Input Capture
- T1573.002 Asymmetric Cryptography
- T1071.004 DNS
- T1041 Exfiltration Over C2 Channel
- T1497 Virtualization/Sandbox Evasion
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1568 Dynamic Resolution

## Sources

- [Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/)
- [Spyware vendors found a way to make targeted ads even worse - The Register](https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334)
- [CitizenLab details new spyware triggered by online advertising - Engadget](https://www.engadget.com/2287417/citizenlab-details-new-spyware-triggered-by-online-advertising/)
- [Citizen Lab Ties Discover-Tech Ad Network to Candiru Spyware - AI Weekly](https://aiweekly.co/alerts/citizen-lab-ties-discover-tech-ad-network-to-candiru-spyware)
- [Zero-click spyware delivered through targeted ads - Cypro](https://cypro.co.uk/insights/cyber-bulletins/zero-click-spyware-delivered-through-targeted-ads/)
- [Israeli Ad Firm Helped Spyware Target Al Jazeera: Report - Punjab Kesari](https://english.punjabkesari.com/world/israeli-ad-company-discovertech-spyware-al-jazeera)
- [John Scott-Railton thread on AdFection](https://x.com/jsrailton/status/2110697179396325585)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3628