Threat reportMalwareTL-2026-3763
AdFection: Zero-click ad-based delivery of Candiru (Integrity Labs) spyware via Discover-Tech's Controlium/NOAS ad infrastructure
AdFection: Zero-click ad-based delivery of Candiru (TL-2026-3763), also tracked as AdFection, is a high-severity malware campaign, first published 2026-10-16. It is attributed to Caramel Tsunami (Israel) with medium confidence, affects Microsoft Windows (10/11) endpoints and browsers/WebView rendering ads, maps to 14 MITRE ATT&CK techniques (T1005, T1016.001, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 2Caramel Tsunami
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3763
- Threat ID
- TL-2026-3763
- Also known as
- AdFection, Controlium, NOAS, DevilsTongue
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Caramel Tsunami, Integrity Labs
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Israel
- Motivation
- ESPIONAGE
- Target sectors
- news - media, government administration, journalism, civil society, defense, international-organizations
- Target regions
- Middle East, Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in AdFection: Zero-click ad-based delivery of Candiru
Malware and tooling: DevilsTongue, Predator, Controlium
How AdFection: Zero-click ad-based delivery of Candiru works
Citizen Lab (Report 195, 2026-10-15) disclosed 'AdFection', in which Israeli ad-tech firm Discover-Tech used real-time-bidding ads carrying script tags that contacted its NOAS servers, which returned exploit code only to pre-selected targets, to deliver Candiru spyware to at least 45 Al Jazeera Windows devices in 2024-2025. Between March and June 2026 the same infrastructure placed 3.77 billion bids across 75,373 apps and 120,768 websites in 161 countries.
AdFection is the first publicly confirmed technical case of zero-click mercenary spyware delivered through the programmatic advertising ecosystem. Discover-Tech Ltd (incorporated in Israel in March 2020; CEO Dekel Boni) operates a campaign control panel called Controlium. Spyware partners upload targeting lists (mobile advertising IDs, browser IDs, IP addresses) and purchase ad impressions through Discover-Tech's own DSP ('MyDSP', connected to Google Ad Manager, Yandex, Vungle and Sunteng) and through Beeswax and Eskimi. Controlium modules include a Tag Generator, creative upload, campaigns, targeting lists, bid-request and impression viewers, and an OpSec admin configuration (bidding frequency limits, domain/app allow and block lists, per-country allow and block lists, daily and monthly caps).
Delivery chain: (1) an ad is won in a real-time-bidding auction (the user does not need to see or click it); (2) the ad creative contains a script tag that, on render, calls a 'NOAS' ('getAd') server and submits the device's IP address and advertising identifier; (3) the NOAS server decides eligibility and returns JavaScript (for example an invisible 1x1 iframe registering an event on logger.powerium.net) or a binary payload only to selected targets, while every other device receives nothing; (4) selected targets are redirected to Candiru 'validator' servers, with encrypted targeting data (IP, timestamp, user-agent, ad ID) passed in base64 '?q=' parameters (the 'Ad URL OpSec' feature); (5) if the device matches and a suitable exploit exists, a Windows DLL implant is installed; (6) the implant persists via COM hijacking and beacons to Candiru C2 servers. Citizen Lab observed a temporal signature of Discover-Tech infrastructure contact, then Candiru validator contact, then Candiru C2 contact. The browser/Windows exploit itself was not captured; the JavaScript served from sincereaccertain.com and d1fcoizt7mje85.cloudfront.net was not recovered by Citizen Lab, and no CVE is stated in any source.
A separate 'Infinite FIFO' mass-profiling feature redirected hundreds of thousands to millions of users to Candiru profiling infrastructure (sincereaccertain.com and a CloudFront distribution, April-December 2025; from January 2026 via ppv2.mtrtb.com, with 3,637,213 'eligible users' counted January-June 2026). World-readable Apache Druid instances (druid.mtrtb.com, cn.druid.mtrtb.com) exposed MyDSP bidding data for March-June 2026: 3,770,286,576 bids, 441,954,291 won (11.7%), about 718.7 million bids (~19%) containing NOAS script tags, upstream exchange share of Yandex 67.4%, Google Ad Manager 24.74% and Vungle 7.24%, and top raw-bid countries Yemen, Pakistan, Montenegro and Brazil. Controlium also had a broken authentication design (auth tokens derived from unencrypted user metadata, with JWT validation commented out) and an unauthenticated /csv-download endpoint exposing 128 days of login logs.
The malware sample tied to the Al Jazeera infections (SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) shares traits with the 2021 Candiru DevilsTongue sample: COM-hijack persistence (different DLL), string obfuscation with a 48-byte repeating XOR key and a 'dummy' terminator, and a hardcoded connectivity check against http://www.google.com and http://www.microsoft.com. Public reporting describes DevilsTongue as capable of stealing files, credentials and messages, and one outlet adds microphone and camera access. Citizen Lab also linked Controlium users to Candiru/Integrity Labs presale staff, to mercenary firms Bindecy and Intelos (whose Controlium logins and infrastructure were identified), and to a mass-deanonymization actor it calls DARK CARTOGRAPHER (WebRTC IP leaks and mobile-carrier MSISDN leaks; active since at least 2019; separate report forthcoming). Discover-Tech also had board and shareholder links to the Intellexa-associated network (Eric Banoun, director 2020-2025).
Discover-Tech ads were observed on networks of sensitive organizations including NATO, the UN, EU institutions, the US Department of Defense (per Confiant), the IAEA and the ICC; being reached by an ad is not evidence of compromise. After disclosure Google terminated Discover-Tech access and, with IAB Europe, removed it from registries (early October 2026); Beeswax and Eskimi blocked accounts and domains; Vungle (Liftoff) paused access pending review; Xandr and Sunteng had not responded within the report timeline. Citizen Lab notes a similar technique, 'Aladdin', documented by Amnesty International in late 2025 for Predator (Intellexa).
MITRE ATT&CK techniques used in TL-2026-3763
Collection
T1005 Data from Local System; T1123 Audio Capture; T1125 Video Capture
Discovery
T1016.001 Internet Connection Discovery
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.007 JavaScript; T1203 Exploitation for Client Execution
Command and Control
Persistence
T1546.015 Component Object Model Hijacking
Credential Access
T1555 Credentials from Password Stores
Resource Development
T1583.001 Domains; T1583.008 Malvertising
Reconnaissance
T1590.005 IP Addresses; T1592 Gather Victim Host Information
Affected products and versions in AdFection: Zero-click ad-based delivery of Candiru
- Microsoft — Windows (10/11) endpoints and browsers/WebView rendering ads
Vulnerable versions: Unpatched Windows browsers/WebView (exploit not disclosed) - Programmatic advertising ecosystem — Real-time-bidding exchanges and DSPs (Google Ad Manager, Yandex, Vungle, Beeswax, Eskimi, Xandr, Sunteng)
Vulnerable versions: Abused as delivery channel
Fixed in: Discover-Tech accounts removed/blocked by Google, Beeswax, Eskimi; Vungle paused access
Remediation for AdFection: Zero-click ad-based delivery of Candiru
Patches
- Keep Windows, Chrome/Chromium-based browsers and WebView components fully patched (the exploit used was not publicly identified; no CVE is stated)
Immediate actions
- Block Discover-Tech infrastructure domains and the Candiru validator and C2 domains listed in the IOCs at DNS and web gateways
- Hunt proxy, DNS and EDR telemetry for requests to NOAS hostnames (mtrtb.com, powerium.net, myweb3id.io, platc-tester.com) followed by contact with Candiru validator or C2 domains
- Block advertising and tracking systems at organizational gateways and on work devices
- Triage high-risk users (journalists, activists, government staff) for COM-hijack persistence and the SHA-256 of the Al Jazeera sample
Workarounds
- Mandatory ad-blocking on government and newsroom devices
- Restrict script execution from ad domains via DNS filtering
Longer-term hardening
- Disable advertising identifiers and personalized advertising on devices of high-risk individuals through MDM
- Deploy EDR with registry/COM-hijack and unsigned-DLL load detection on Windows endpoints
- Require third-party audits and stricter onboarding of ad-tech vendors; sandbox ad creative code
- Use Lockdown/hardened browser profiles and disable WebRTC leaks for high-risk users
Timeline of AdFection: Zero-click ad-based delivery of Candiru
- Discover-Tech Ltd incorporated in Israel (March 2020); Eric Banoun joins the board in April 2020.
- Earliest activity of the 305 Candiru validator domains on 319 IPs identified by Citizen Lab (August 2022 - July 2026).
- At least 45 Al Jazeera Media Network devices targeted with Candiru spyware via Discover-Tech ads across 2024-2025 (exact month not given; first-of-year used as approximation).
- Three Candiru-cluster domains registered within hours using the rockhoster registrant.
- Infinite FIFO mass-profiling deployment begins, redirecting users to sincereaccertain.com and a CloudFront distribution (April-December 2025); sincereaccertain.com begins distributing encrypted targeting URLs in May 2025.
- ppv2.mtrtb.com NOAS URL used with Infinite FIFO; 3,637,213 eligible users counted January-June 2026.
- Start of the March-June 2026 window of exposed MyDSP bidding data: 3.77 billion bids, 442 million won, 75,373 apps and 120,768 websites in 161 countries.
- Exposed Druid instances druid.mtrtb.com and cn.druid.mtrtb.com shut down (August 2026).
- Google and IAB Europe remove Discover-Tech from registries and terminate access (early October 2026); Beeswax and Eskimi block accounts, Vungle pauses access.
- Citizen Lab publishes Report 195 'Exposing AdFection', with Confiant publishing related findings.
- BleepingComputer and other outlets report the campaign.
Sources cited for AdFection: Zero-click ad-based delivery of Candiru
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab Report 195)
- Zero-click attacks used targeted ads to deliver Candiru spyware (BleepingComputer)
- AdFection: How mercenary spyware invades victims' devices through targeted advertising (CyberScoop)
- Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware (Hackread)
- Israeli ad firm used online ads to spread Candiru spyware, report finds (The Next Web)
- Citizen Lab Says Targeted Ads Delivered Zero-Click Spyware to Al Jazeera (Technology.org)
- Citizen Lab uncovers use of online ads to deliver spyware (Digital Watch)
- Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus (Citizen Lab, 2021)
Detection coverage for TL-2026-3763
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3763 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.