# AdFection: Discover-Tech Targeted Ads Used to Deliver Candiru Zero-Click Spyware; U.S. and E.U. Politicians Call Ad Tech a Security Risk

> Citizen Lab (Report 195, 2026-10-15) documented 'AdFection', the first public technical confirmation of mercenary spyware (Candiru) delivered via targeted ads bought through real-time bidding by Israeli ad-tech firm Discover-Tech, with at least 45 Al Jazeera devices targeted in 2024-2025. On 2026-10-28 Citizen Lab reported that U.S. Senators Booker and Wyden and Members of the European Parliament are warning that targeted advertising is a zero-click spyware delivery risk, and an MEP letter urges an E.U. investigation into institutional exposure.

- **Published:** 2026-10-28T15:02:31Z
- **Last reviewed:** 2026-10-28T15:02:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4648
- **ID:** TL-2026-4648
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** Caramel Tsunami (Israel)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Citizen Lab's 'Exposing AdFection' research (Report 195, published 2026-10-15; authors Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, Ron Deibert; reported with Confiant) links Israeli ad-tech company Discover-Tech to delivery of Candiru mercenary spyware through the programmatic advertising ecosystem. Discover-Tech operated the Controlium targeting/fingerprinting platform and a MyDSP bidding platform, and bought ad placements through mainstream exchanges and DSPs. It was listed as an approved vendor by Google and IAB Europe from 2020 until early October 2026.

Mechanics as reported: an ad that wins an auction renders in a website or mobile app and its script tag calls a Discover-Tech 'NOAS' /getAd endpoint, sending the device's IP address and advertising identifier. The server returns JavaScript only for selected targets; all other devices receive an empty response. On targets, the script loads a hidden iframe pointing at a Candiru 'validator' server (roughly 1-2 seconds after the impression), exploit-server contact follows at about 5-10 seconds, and a command channel to Candiru C2 is established in roughly 1-3 minutes. No user interaction is required (zero-click). A Windows DLL recovered from an Al Jazeera device was attributed to Candiru with high confidence; per a secondary write-up it uses COM-hijack persistence and a 48-byte repeating XOR key for string obfuscation. The specific 2024-2025 exploit chain/CVEs were not published in the sources reviewed (Candiru's 2021 chains used Windows kernel and Chrome zero-days, referenced historically only).

Scale: Citizen Lab examined about 3.77 billion bids between March and June 2026 (about 442 million won auctions), spanning 75,373 Android/iOS apps and 120,768 websites; about 718.7 million bids (roughly 19%) carried code capable of contacting the spyware-delivery infrastructure. Ads reached government, military, critical-infrastructure, media and multilateral networks (including NATO and UN networks) across roughly two dozen countries. At least 45 Al Jazeera devices were targeted in 2024-2025 after Al Jazeera's IT team noticed unusual activity in 2024. Citizen Lab also described a companion technique, DARK CARTOGRAPHER, that links advertising IDs to phone numbers to deanonymize users. Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi acted after disclosure to cut Discover-Tech's access.

Policy response (Citizen Lab, 2026-10-28): Democratic Senators Cory Booker and Ron Wyden said the findings underscore the need for better industry security practices and Wyden warned that allowing targeted ads on government devices is an open invitation to spies; Members of the European Parliament signed a letter urging an E.U. investigation into institutional exposure. Related Citizen Lab work covers Pegasus and mercenary spyware attacks on Serbian pro-democracy figures (2026-10-19), which is separate from the AdFection delivery chain.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1592 Gather Victim Host Information
- T1059.007 JavaScript
- T1203 Exploitation for Client Execution
- T1546.015 Component Object Model Hijacking
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- T1005 Data from Local System

## Sources

- [Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk](https://citizenlab.ca/politicians-in-u-s-and-e-u-say-targeted-ads-are-a-security-risk/)
- [Exposing AdFection (Citizen Lab Report 195)](https://citizenlab.ca/research/exposing-adfection/)
- [Targeted ads installed Candiru spyware in zero-click attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/)
- [Citizen Lab traces zero-click Candiru (The Hacker News)](https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html)
- [Report: Israeli ad-tech firm enables spyware targeting of at least 45 Al Jazeera devices (CPJ)](https://cpj.org/2026/10/report-israeli-ad-tech-firm-enables-spyware-targeting-of-at-least-45-al-jazeera-devices/)
- [Israeli ad-tech firm helped place spyware on Al Jazeera devices (Al Jazeera)](https://www.aljazeera.com/news/2026/10/15/israeli-ad-tech-firm-helped-spy-on-al-jazeera-devices)
- [First Mercenary Spyware Delivered Via Targeted Ads Uncovered by CitizenLab (Privacy Guides)](https://www.privacyguides.org/news/2026/10/16/first-mercenary-spyware-delivered-via-targeted-ads-uncovered-by-citizenlab/)
- [AdFection: Discover-Tech Zero-Click Spyware via Targeted Ads - technical indicators (Safeguard)](https://safeguard.sh/resources/blog/adfection-discover-tech-zero-click-spyware-targeted-ads)
- [AdFection: Targeted Ads Delivered Candiru Spyware Without a Click (GridinSoft)](https://blog.gridinsoft.com/adfection-targeted-ads-candiru-spyware/)
- ['AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery (Dark Reading)](https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4648