Key points
- Citizen Lab identified a zero-click attack vector called AdFection that delivers Candiru spyware through online advertisements.
- The campaign targeted at least 45 devices at Al Jazeera using ads purchased by the Israeli firm Discover-Tech.
- Researchers found that the ad-tech platform Controlium allowed precise targeting and contained authentication weaknesses.
Citizen Lab has confirmed the first public instance of zero-click mercenary spyware delivered via targeted online ads, a technique the group calls AdFection. The campaign specifically targeted devices at Al Jazeera with Candiru spyware. The malicious advertisements were purchased by an Israeli ad-tech firm named Discover-Tech, leveraging real-time auction mechanisms to reach specific victims without requiring any user interaction or clicks.
By the numbers
- 45: The number of Al Jazeera devices targeted by the Candiru spyware campaign.
- 128: The number of days of login logs exposed via an unauthenticated endpoint on the Controlium platform.
- 200,000: The approximate number of websites and apps where Discover-Tech ads appeared over four months.
What the figures mean
The scale of Discover-Tech’s ad placement indicates that the infrastructure used for this attack was widespread and integrated into major digital ecosystems. Citizen Lab linked the attacks to Candiru, now rebranded as Integrity Labs, with high confidence. Network logs revealed a consistent sequence: devices contacted Discover-Tech infrastructure, then a Candiru validator server, and finally a command-and-control server. This pattern suggests a systematic approach to identifying and compromising specific targets through legitimate advertising channels.
What to watch
Discover-Tech appeared on certified vendor lists from Google and IAB Europe from 2020 to 2026, highlighting the risk of trusting certified ad-tech providers. Researchers found that Controlium, the platform used to select victims, misused Auth0 authentication. This flaw potentially allows attackers to forge authentication tokens. Additionally, an unauthenticated endpoint exposed login logs for 120 usernames, demonstrating significant security gaps in the ad-tech supply chain that could be exploited for further reconnaissance or unauthorized access.
Infection and persistence in general
Teams usually monitor network traffic for unusual outbound connections to unknown domains following ad impressions. Analysts should check for scripts that send device identifiers to external servers, as these may signal targeted reconnaissance. Persistence mechanisms often involve legitimate system components, such as COM hijacking, to maintain access without detection. Security operations should validate the integrity of advertising SDKs and review server-side logs for anomalies in user-agent strings or request patterns that deviate from standard ad-serving behavior.
Background: Spyware
Look for unexplained battery drain, microphone LED activity, or network traffic spikes. Check for unknown admin accounts and disabled security tools. Isolate the device immediately. Do not attempt to clean it while connected to the network. Assume data is already exposed.
Read the full guide: Spyware Warning Signs: What to Spot Before Data Is Stolen
What to do and how to stay safe: Candiru
- Monitor network logs for connections to known malicious command-and-control domains associated with spyware campaigns.
- Review ad-tech vendor contracts and security certifications to ensure they meet rigorous safety standards.
- Implement strict network segmentation to limit the impact of compromised devices on critical infrastructure.
- Once the vendor provides an update, apply patches to address authentication flaws in ad-serving platforms.
Step-by-step guide: Ransomware Incident Response: A Step-by-Step Operational Playbook
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a technique identified by Citizen Lab where zero-click mercenary spyware is delivered through targeted online ads.
Which spyware was used in this campaign?
The campaign used Candiru spyware, which has since been rebranded as Integrity Labs.
How did the attackers target specific devices?
Attackers used Discover-Tech’s Controlium platform to target devices based on mobile ad IDs, cookie IDs, or IP addresses.
