Threat reportMalwareTL-2026-4648
AdFection: Discover-Tech Targeted Ads Used to Deliver Candiru Zero-Click Spyware; U.S. and E.U. Politicians Call Ad Tech a Security Risk
AdFection: Discover-Tech Targeted Ads Used to Deliver (TL-2026-4648), also tracked as AdFection, is a high-severity malware campaign, first published 2026-10-28. It is attributed to Caramel Tsunami (Israel) with high confidence, affects Programmatic advertising ecosystem Real-time bidding exchanges, SSPs, maps to 10 MITRE ATT&CK techniques (T1005, T1027, T1059.007), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 3Caramel Tsunami
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4648
- Threat ID
- TL-2026-4648
- Also known as
- AdFection, DARK CARTOGRAPHER (companion ad-ID deanonymization technique)
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Caramel Tsunami, Integrity Labs, Discover-Tech
- Attribution confidence
- HIGH
- Nation-state nexus
- Israel
- Motivation
- ESPIONAGE
- Target sectors
- news - media, government administration, military, critical-infrastructure, multilateral-organizations, technology
- Target regions
- Middle East, Europe, North America, Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in AdFection: Discover-Tech Targeted Ads Used to Deliver
Malware and tooling: Candiru, DevilsTongue, Controlium
How AdFection: Discover-Tech Targeted Ads Used to Deliver works
Citizen Lab (Report 195, 2026-10-15) documented 'AdFection', the first public technical confirmation of mercenary spyware (Candiru) delivered via targeted ads bought through real-time bidding by Israeli ad-tech firm Discover-Tech, with at least 45 Al Jazeera devices targeted in 2024-2025. On 2026-10-28 Citizen Lab reported that U.S. Senators Booker and Wyden and Members of the European Parliament are warning that targeted advertising is a zero-click spyware delivery risk, and an MEP letter urges an E.U. investigation into institutional exposure.
Citizen Lab's 'Exposing AdFection' research (Report 195, published 2026-10-15; authors Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, Ron Deibert; reported with Confiant) links Israeli ad-tech company Discover-Tech to delivery of Candiru mercenary spyware through the programmatic advertising ecosystem. Discover-Tech operated the Controlium targeting/fingerprinting platform and a MyDSP bidding platform, and bought ad placements through mainstream exchanges and DSPs. It was listed as an approved vendor by Google and IAB Europe from 2020 until early October 2026.
Mechanics as reported: an ad that wins an auction renders in a website or mobile app and its script tag calls a Discover-Tech 'NOAS' /getAd endpoint, sending the device's IP address and advertising identifier. The server returns JavaScript only for selected targets; all other devices receive an empty response. On targets, the script loads a hidden iframe pointing at a Candiru 'validator' server (roughly 1-2 seconds after the impression), exploit-server contact follows at about 5-10 seconds, and a command channel to Candiru C2 is established in roughly 1-3 minutes. No user interaction is required (zero-click). A Windows DLL recovered from an Al Jazeera device was attributed to Candiru with high confidence; per a secondary write-up it uses COM-hijack persistence and a 48-byte repeating XOR key for string obfuscation. The specific 2024-2025 exploit chain/CVEs were not published in the sources reviewed (Candiru's 2021 chains used Windows kernel and Chrome zero-days, referenced historically only).
Scale: Citizen Lab examined about 3.77 billion bids between March and June 2026 (about 442 million won auctions), spanning 75,373 Android/iOS apps and 120,768 websites; about 718.7 million bids (roughly 19%) carried code capable of contacting the spyware-delivery infrastructure. Ads reached government, military, critical-infrastructure, media and multilateral networks (including NATO and UN networks) across roughly two dozen countries. At least 45 Al Jazeera devices were targeted in 2024-2025 after Al Jazeera's IT team noticed unusual activity in 2024. Citizen Lab also described a companion technique, DARK CARTOGRAPHER, that links advertising IDs to phone numbers to deanonymize users. Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi acted after disclosure to cut Discover-Tech's access.
Policy response (Citizen Lab, 2026-10-28): Democratic Senators Cory Booker and Ron Wyden said the findings underscore the need for better industry security practices and Wyden warned that allowing targeted ads on government devices is an open invitation to spies; Members of the European Parliament signed a letter urging an E.U. investigation into institutional exposure. Related Citizen Lab work covers Pegasus and mercenary spyware attacks on Serbian pro-democracy figures (2026-10-19), which is separate from the AdFection delivery chain.
MITRE ATT&CK techniques used in TL-2026-4648
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails
Execution
T1059.007 JavaScript; T1203 Exploitation for Client Execution
Command and Control
Persistence
T1546.015 Component Object Model Hijacking
Resource Development
T1583.001 Domains; T1583.008 Malvertising
Reconnaissance
Affected products and versions in AdFection: Discover-Tech Targeted Ads Used to Deliver
- Programmatic advertising ecosystem — Real-time bidding exchanges, SSPs and DSPs (Google ad exchanges, Beeswax, Vungle/Liftoff, Eskimi, Yandex)
Vulnerable versions: All ad-rendering contexts reached by Discover-Tech bids, Mar-Jun 2026 - Various — Android/iOS apps (75,373) and websites (120,768) rendering Discover-Tech ads
Vulnerable versions: Ad-rendering webviews and browsers - Microsoft — Windows (Candiru DLL implant recovered from Al Jazeera device)
Vulnerable versions: Not specified in sources
Remediation for AdFection: Discover-Tech Targeted Ads Used to Deliver
Patches
- No vendor patch identified; the 2024-2025 exploit chain was not published in the reviewed sources. Keep browsers and OS fully updated.
Immediate actions
- Block the Discover-Tech, validator and Candiru C2 domains listed in the IOC set at DNS/proxy and egress
- Hunt DNS/proxy logs for requests to mtrtb.com /getAd endpoints and the listed validator/C2 domains
- Scan Windows endpoints for the Candiru DLL SHA-256 and COM-hijack persistence artifacts
- Enforce ad/content blocking on high-risk user and government devices
Workarounds
- Use DNS-level and browser content blockers to stop ad scripts reaching Discover-Tech infrastructure
- Disable or limit in-app advertising where feasible on managed mobile devices
Longer-term hardening
- Restrict programmatic ads on government and sensitive-organization networks and managed devices
- Enable Apple Lockdown Mode / Android Advanced Protection for high-risk users
- Keep browsers, OS and apps patched to limit browser-exploit delivery
- Prefer allow-listed ad supply paths and vet SSP/DSP vendors for publishers and enterprises
Timeline of AdFection: Discover-Tech Targeted Ads Used to Deliver
- Candiru added to the U.S. trade blacklist (2021); Citizen Lab had published a technical analysis of its spyware in 2021, including Windows kernel and Chrome zero-day chains.
- Al Jazeera's IT team noticed unusual patterns on journalists' devices in 2024 (exact date not stated; year-start placeholder) and approached Citizen Lab; at least 45 Al Jazeera devices were ultimately found targeted across 2024-2025.
- Per secondary reporting of the Citizen Lab report, Discover-Tech's 'infinite FIFO' targeting evolved in January 2026 (day not stated); ppv2.mtrtb.com began counting about 3.6M 'eligible users'.
- Start of the March-June 2026 window in which Citizen Lab examined about 3.77 billion Discover-Tech bids across 75,373 apps and 120,768 websites (start date approximate).
- End of the March-June 2026 bid-record window (end date approximate); about 718.7 million bids carried NOAS code able to contact spyware delivery infrastructure.
- Early October 2026: after Citizen Lab disclosure, Google removed Discover-Tech from its vendor lists, IAB Europe suspended it from its Global Vendor List, and Beeswax, Vungle (Liftoff) and Eskimi disconnected its access (day approximate).
- Citizen Lab published 'Exposing AdFection' (Report 195), the first public technical confirmation of mercenary spyware delivered via targeted ads; Al Jazeera and CPJ publicized the findings.
- Citizen Lab published related research on Pegasus and mercenary spyware attacks on Serbian pro-democracy figures (separate campaign from AdFection).
- Citizen Lab reported that U.S. Senators Booker and Wyden and Members of the European Parliament are warning that targeted ad tech is a zero-click spyware risk; an MEP letter urges an E.U. investigation into institutional exposure.
Sources cited for AdFection: Discover-Tech Targeted Ads Used to Deliver
- Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk
- Exposing AdFection (Citizen Lab Report 195)
- Targeted ads installed Candiru spyware in zero-click attacks (BleepingComputer)
- Citizen Lab traces zero-click Candiru (The Hacker News)
- Report: Israeli ad-tech firm enables spyware targeting of at least 45 Al Jazeera devices (CPJ)
- Israeli ad-tech firm helped place spyware on Al Jazeera devices (Al Jazeera)
- First Mercenary Spyware Delivered Via Targeted Ads Uncovered by CitizenLab (Privacy Guides)
- AdFection: Discover-Tech Zero-Click Spyware via Targeted Ads - technical indicators (Safeguard)
- AdFection: Targeted Ads Delivered Candiru Spyware Without a Click (GridinSoft)
- 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery (Dark Reading)
Detection coverage for TL-2026-4648
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4648 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.