Threat intel
AdFection: spyware delivered by an ad nobody clicked
Citizen Lab says Israeli ad firm Discover-Tech let Candiru pick targets and infect them through ads. How it worked, and how to cut ads off work devices.
On October 15, Citizen Lab at the University of Toronto published "AdFection", a report on Discover-Tech, an Israeli company registered in 2020 that presents itself as an ad tech firm. Citizen Lab says Discover-Tech's platform, Controlium, let spyware vendors choose individual people and push ads at them that could install spyware when they were displayed, with no click needed. The ad security firm Confiant ran a parallel investigation, and Google, which worked with both, has removed Discover-Tech from its ad platforms.
The headline case is Al Jazeera. Citizen Lab links attacks on at least 45 devices inside the broadcaster in 2024 and 2025, with high confidence, to spyware made by Candiru, an Israeli vendor the US placed on its Entity List in 2021. Discover-Tech's ads also showed up on networks used by governments, NATO, UN and EU bodies and critical infrastructure. Citizen Lab stresses that an ad reaching a network is not proof that anyone there was targeted. Still, if your staff browse the web or use ad-funded apps on work devices, the ad supply chain reaches into your network, and the report shows it being used as a delivery channel.
How it works
Programmatic advertising runs an auction for every ad slot. When a page or app loads, a supply-side platform (SSP) offers the impression, and demand-side platforms (DSPs) bid for it based on what they know about the viewer: a cookie ID, a mobile advertising ID, an IP address. Discover-Tech ran its own DSP, MyDSP, which Citizen Lab says bought through Google, Yandex, Vungle (Liftoff) and Sunteng, and also through Eskimi and Comcast's Beeswax.
Controlium sat on top of that. Citizen Lab describes a control panel where a customer picks targets by mobile advertising ID, browser cookie ID (MyDSP or Beeswax) or IP address, with admin limits on countries, domains, apps and campaign volume. When Discover-Tech wins an auction, its ad carries a script tag pointing at a Discover-Tech server the researchers call NOAS (it answers on /getAd). The device sends its advertising identifiers, cookies and public IPv6 address. For almost everyone the server returns a 0-byte reply, so ad partners and scanners see nothing harmful. For a selected device it returns JavaScript that can load more code, including a browser exploit. The ad can render in the background, so the user may never see it.
After the exploit, the device contacts a Candiru "validator" server, which checks it before profiling and infection, and finally a Candiru command and control (C&C) server. Al Jazeera's network logs showed that sequence, and the broadcaster supplied a Windows DLL from one compromised device. Citizen Lab tied that sample to Candiru's 2021 tooling through a COM hijack used for persistence, a 48-byte repeating XOR key and a hardcoded connectivity check against google.com and microsoft.com.
Citizen Lab does not name the browser exploit or the vulnerability used in AdFection, and we found no source that does. For background only: Candiru's earlier campaigns used Chrome and Windows zero-days, including the Windows pair CVE-2021-31979 and CVE-2021-33771 that Microsoft patched in July 2021.
What attackers are doing
The researchers found exposed Discover-Tech data stores holding nearly four billion bidding records. From March to June 2026, MyDSP bid on 3,770,286,576 impressions and won 441,954,291 of them. Ads with the attacker script tag were displayed in 75,373 Android and iOS apps and on 120,768 websites. Reuters, quoted by Calcalist, rounds these to more than 75,000 apps and 120,000 websites; Security Affairs gives 70,000 apps. One endpoint alone counted 3,637,213 "eligible users" between January and June 2026.
An unauthenticated download endpoint on Controlium exposed 128 days of login logs with 120 usernames. From those, Citizen Lab links users to Candiru (two accounts named INTEGRITYPRESALE1 and INTEGRITYPRESALE2 logged in from an Integrity Labs address in Israel) and to two other surveillance firms, Bindecy and Intelos. That makes Discover-Tech a service with several spyware customers, and Citizen Lab says it cannot tie each campaign to a specific end customer.
The accounts of the Al Jazeera case differ slightly. Citizen Lab says at least 45 devices were targeted; Reuters reports 45 Windows devices compromised. Candiru's naming is also unsettled. Citizen Lab says it rebranded as Integrity Labs, citing Recorded Future, while Forbes and Israeli media reported that US firm Integrity Partners acquired Candiru's operations in 2025; Citizen Lab calls the acquisition's status unclear.
Google says it removed Discover-Tech "for systematically violating our policies". IAB Europe suspended it from its approved vendor list, Beeswax removed it, Eskimi blocked its accounts and Vungle paused its access. Discover-Tech, Candiru, Bindecy and Intelos did not respond before publication.
What to do
1. Block ads at the gateway and on managed devices
Citizen Lab's main advice to defenders is to block advertising and tracking at the organisation's gateway and on work-issued devices, and it calls for mandatory ad-blocking on government devices. In practice that means an ad and tracker blocklist on the DNS resolver or secure web gateway your devices are forced to use, plus a managed content-blocking extension pushed by policy to every browser. Because the malicious reply goes only to selected devices, filtering on reputation alone will not catch this; removing the ad request is what takes the channel away.
2. Block and hunt the published domains
Appendix C of the report lists Discover-Tech and Controlium infrastructure, including discover-tech[.]io, mtrtb[.]com, mydsp[.]io, controlium[.]net, powerium[.]net, myweb3id[.]io, myipinfo[.]io and adtimizer[.]co, with NOAS hosts such as noas.mtrtb[.]com and ppv2.mtrtb[.]com. It also lists Candiru C&C domains (fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com), profiling domains such as sincereaccertain[.]com, and the sample hash 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. Add them to DNS and proxy deny lists, then search resolver and proxy logs back to January 2024.
A hit on a Discover-Tech domain alone usually means an ad was shown. The pattern that matters is the one Citizen Lab saw at Al Jazeera: a Discover-Tech request followed by a connection to a Candiru validator or C&C domain from the same device. Treat that device as compromised, isolate it and get forensic help before wiping it. Run the hash through your endpoint detection tool too.
3. Shrink the targeting data on phones
Targets were selected by advertising ID, cookie ID and IP address. Citizen Lab tells individuals to reset or disable mobile advertising IDs and to use ad-blocking DNS or VPN services. On managed phones, push a DNS filtering profile, delete the Android advertising ID, keep iOS app tracking requests turned off, and prefer browsers with built-in tracking protection.
4. Harden the people most likely to be chosen
Journalists, executives and staff with access to sensitive systems are the people a Controlium customer would pick. Give them the strictest setup: browser and operating system updates applied within days, Apple's Lockdown Mode on iPhones and Macs, which restricts web features that exploits commonly abuse, and Chrome's Enhanced Safe Browsing. None of the sources say these would have stopped this exploit, but they cut the exposure the report describes. Keep their device and DNS logs long enough to run the hunt in step 2 when the next report lands.
Ads are third-party code
Every ad slot runs code chosen at auction by a company you never vetted, and AdFection shows that code can be tailored to one person. Citizen Lab also tells defenders to monitor traffic linked to ad impressions. If your organisation already treats browser extensions and unknown executables as risks, ad delivery belongs on the same list.
Our safeguarding and hardening work sets up gateway filtering and locked-down profiles for high-risk staff, and our security operations team can run the DNS and proxy hunt for these domains across your logs. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Citizen Lab, Forbes, Calcalist (Reuters), Al Jazeera, Security Affairs, Engadget.