# AdFection: Zero-click ad-based delivery of Candiru (Integrity Labs) spyware via Discover-Tech's Controlium/NOAS ad infrastructure

> Citizen Lab (Report 195, 2026-10-15) disclosed 'AdFection', in which Israeli ad-tech firm Discover-Tech used real-time-bidding ads carrying script tags that contacted its NOAS servers, which returned exploit code only to pre-selected targets, to deliver Candiru spyware to at least 45 Al Jazeera Windows devices in 2024-2025. Between March and June 2026 the same infrastructure placed 3.77 billion bids across 75,373 apps and 120,768 websites in 161 countries.

- **Published:** 2026-10-16T17:47:23Z
- **Last reviewed:** 2026-10-16T17:47:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3763
- **ID:** TL-2026-3763
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Caramel Tsunami (Israel)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AdFection is the first publicly confirmed technical case of zero-click mercenary spyware delivered through the programmatic advertising ecosystem. Discover-Tech Ltd (incorporated in Israel in March 2020; CEO Dekel Boni) operates a campaign control panel called Controlium. Spyware partners upload targeting lists (mobile advertising IDs, browser IDs, IP addresses) and purchase ad impressions through Discover-Tech's own DSP ('MyDSP', connected to Google Ad Manager, Yandex, Vungle and Sunteng) and through Beeswax and Eskimi. Controlium modules include a Tag Generator, creative upload, campaigns, targeting lists, bid-request and impression viewers, and an OpSec admin configuration (bidding frequency limits, domain/app allow and block lists, per-country allow and block lists, daily and monthly caps).

Delivery chain: (1) an ad is won in a real-time-bidding auction (the user does not need to see or click it); (2) the ad creative contains a script tag that, on render, calls a 'NOAS' ('getAd') server and submits the device's IP address and advertising identifier; (3) the NOAS server decides eligibility and returns JavaScript (for example an invisible 1x1 iframe registering an event on logger.powerium.net) or a binary payload only to selected targets, while every other device receives nothing; (4) selected targets are redirected to Candiru 'validator' servers, with encrypted targeting data (IP, timestamp, user-agent, ad ID) passed in base64 '?q=' parameters (the 'Ad URL OpSec' feature); (5) if the device matches and a suitable exploit exists, a Windows DLL implant is installed; (6) the implant persists via COM hijacking and beacons to Candiru C2 servers. Citizen Lab observed a temporal signature of Discover-Tech infrastructure contact, then Candiru validator contact, then Candiru C2 contact. The browser/Windows exploit itself was not captured; the JavaScript served from sincereaccertain.com and d1fcoizt7mje85.cloudfront.net was not recovered by Citizen Lab, and no CVE is stated in any source.

A separate 'Infinite FIFO' mass-profiling feature redirected hundreds of thousands to millions of users to Candiru profiling infrastructure (sincereaccertain.com and a CloudFront distribution, April-December 2025; from January 2026 via ppv2.mtrtb.com, with 3,637,213 'eligible users' counted January-June 2026). World-readable Apache Druid instances (druid.mtrtb.com, cn.druid.mtrtb.com) exposed MyDSP bidding data for March-June 2026: 3,770,286,576 bids, 441,954,291 won (11.7%), about 718.7 million bids (~19%) containing NOAS script tags, upstream exchange share of Yandex 67.4%, Google Ad Manager 24.74% and Vungle 7.24%, and top raw-bid countries Yemen, Pakistan, Montenegro and Brazil. Controlium also had a broken authentication design (auth tokens derived from unencrypted user metadata, with JWT validation commented out) and an unauthenticated /csv-download endpoint exposing 128 days of login logs.

The malware sample tied to the Al Jazeera infections (SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) shares traits with the 2021 Candiru DevilsTongue sample: COM-hijack persistence (different DLL), string obfuscation with a 48-byte repeating XOR key and a 'dummy' terminator, and a hardcoded connectivity check against http://www.google.com and http://www.microsoft.com. Public reporting describes DevilsTongue as capable of stealing files, credentials and messages, and one outlet adds microphone and camera access. Citizen Lab also linked Controlium users to Candiru/Integrity Labs presale staff, to mercenary firms Bindecy and Intelos (whose Controlium logins and infrastructure were identified), and to a mass-deanonymization actor it calls DARK CARTOGRAPHER (WebRTC IP leaks and mobile-carrier MSISDN leaks; active since at least 2019; separate report forthcoming). Discover-Tech also had board and shareholder links to the Intellexa-associated network (Eric Banoun, director 2020-2025).

Discover-Tech ads were observed on networks of sensitive organizations including NATO, the UN, EU institutions, the US Department of Defense (per Confiant), the IAEA and the ICC; being reached by an ad is not evidence of compromise. After disclosure Google terminated Discover-Tech access and, with IAB Europe, removed it from registries (early October 2026); Beeswax and Eskimi blocked accounts and domains; Vungle (Liftoff) paused access pending review; Xandr and Sunteng had not responded within the report timeline. Citizen Lab notes a similar technique, 'Aladdin', documented by Amnesty International in late 2025 for Predator (Intellexa).

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1592 Gather Victim Host Information
- T1590.005 IP Addresses
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1546.015 Component Object Model Hijacking
- T1027 Obfuscated Files or Information
- T1016.001 Internet Connection Discovery
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Web Protocols

## Sources

- [Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (Citizen Lab Report 195)](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/)
- [Zero-click attacks used targeted ads to deliver Candiru spyware (BleepingComputer)](https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/)
- [AdFection: How mercenary spyware invades victims' devices through targeted advertising (CyberScoop)](https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/)
- [Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware (Hackread)](https://hackread.com/targeted-ads-infect-al-jazeera-devices-candiru-spyware/)
- [Israeli ad firm used online ads to spread Candiru spyware, report finds (The Next Web)](https://thenextweb.com/news/citizen-lab-targeted-ads-spyware)
- [Citizen Lab Says Targeted Ads Delivered Zero-Click Spyware to Al Jazeera (Technology.org)](https://www.technology.org/2026/10/16/citizen-lab-adfection-discover-tech-candiru-al-jazeera/)
- [Citizen Lab uncovers use of online ads to deliver spyware (Digital Watch)](https://dig.watch/updates/citizen-lab-uncovers-use-of-online-ads-spyware)
- [Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus (Citizen Lab, 2021)](https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3763