AdFection: Candiru zero-click spyware delivered via targeted ads

On 15 October 2026, the Citizen Lab at the University of Toronto published the first public technical evidence of mercenary spyware delivered through targeted advertising, with no click from the victim. The technique has been named AdFection. At its centre is Discover-Tech, an Israeli company registered in 2020 that presents itself as an advertising firm but, according to the researchers, mainly acts as a bridge between the online ad ecosystem and spyware vendors. A parallel investigation by ad security company Confiant confirmed and broadened the picture.

What happened

According to the report, consistently covered by all outlets, in 2024 and 2025 at least 45 devices at the broadcaster Al Jazeera were targeted in zero-click attacks that the Citizen Lab links with high confidence to Candiru’s spyware, delivered through Discover-Tech ads. Candiru, now also known as Integrity Labs, has been on the US Commerce Department’s Entity List since 2021. Al Jazeera took part in the investigation by sharing its network logs.

Beyond Candiru, the researchers found links between Discover-Tech and Bindecy, another intrusion tool vendor, and Intelos, an advertising intelligence firm. None of the companies responded to requests for comment. The Citizen Lab does not attribute the attacks to a specific government.

How the attack chain works

Discover-Tech buys ad space in the real-time bidding auctions of the major platforms, including, according to the sources, those of Google, Yandex and Beeswax. Each bid request carries device data: mobile advertising ID, IP address, location, browser characteristics. According to Ars Technica and CSO Online, the company also used GDPR consent frameworks to reach users in the European Union.

The chain described by the Citizen Lab and reported by BleepingComputer and SecurityWeek is as follows:

1. the ad contains JavaScript that, as soon as the ad is rendered (even only in the background), contacts a Discover-Tech server called NOAS (or “getAd”) and sends the advertising ID and IP;
2. the server decides whether the device is a target. Almost always it returns nothing: the platforms’ verification systems see a harmless banner, and Discover-Tech never hands malicious code to the companies serving the ads;
3. selected targets receive further code, which leads to Candiru’s validation servers;
4. from there the exploit is launched and, finally, the device contacts the spyware’s command-and-control servers.

The researchers saw exactly this sequence in Al Jazeera’s logs. From a compromised Windows computer they recovered a DLL attributed to Candiru based on code and infrastructure overlaps with known samples. Discover-Tech’s management platform is called Controlium: according to the report, it lets customers de-anonymise, fingerprint and automatically infect a device the moment the ad is displayed.

The sources diverge on one point: TechCrunch, BleepingComputer and CSO Online refer to Windows computers at Al Jazeera, while Ars Technica writes that the attacks worked on iOS and Android. The exploited vulnerabilities have not been described: there are no CVEs linked to the case.

MITRE ATT&CK (our mapping, based on the reported facts): T1583.008 (Malvertising), T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution).

The scale

The researchers analysed nearly 4 billion bid records left exposed on a Discover-Tech server. Between March and June 2026, the company’s MyDSP platform placed 3.77 billion bids and won about 442 million, three quarters of them inside mobile apps. Ads carrying the attacker’s script appeared in 75,373 Android and iOS apps and on 120,768 websites. According to the Citizen Lab, between hundreds of thousands and millions of devices were directed to Candiru domains, likely for large-scale tracking and reconnaissance.

The ads were also displayed on sensitive networks: NATO, the United Nations, European lawmaking bodies, critical infrastructure in Australia, armed forces and government agencies in Norway and Sweden. Confiant adds the US Department of Defense, Estonia’s Information System Authority (RIA), the IAEA and the International Criminal Court. An impression is not an infection: the researchers stress this, but note that those networks could have been profiled.

Another actor, dubbed DARK CARTOGRAPHER, uses Discover-Tech’s infrastructure and vulnerabilities at several mobile carriers to link advertising IDs to phone numbers. The Citizen Lab will describe it in a separate report.

After being notified, Google cut Discover-Tech off from its platforms and enabled Safe Browsing warnings; IAB Europe suspended it from the Global Vendor List; Beeswax and Eskimi blocked it, and Vungle (Liftoff) paused its access.

Impact for European and Italian organisations

AdFection adds a vector that phishing awareness training does not cover: simply opening a website or an app with ads is enough. The most exposed profiles are newsrooms, executives, law firms, public administration, defence and research. For NIS2 entities, advertising effectively becomes an unvetted third party running code on company devices, to be considered in supply chain risk management.

What to do now

1. Block ads at the gateway: the Citizen Lab calls this the most feasible protection until the industry proves it can stop these vectors. Filter ad and tracking domains at DNS or proxy level, so that in-app ads on managed phones are covered too.
2. Disable advertising identifiers on company devices through MDM and restrict ad-supported consumer apps; according to the report, without the identifier this method would not have worked.
3. Deploy ad blocking in managed browsers through policy and prefer browsers with tracking protection.
4. Search DNS and proxy logs for the domains published in the Citizen Lab report, including historical data.
5. Enable Lockdown Mode on the iPhones of the most exposed people and keep systems and browsers updated: the ad is only the delivery vehicle, the exploit still needs a vulnerability.

How ARXDOME helps

ARXDOME does not analyse smartphones: there, the control point remains the MDM console. On computers, ARX Sentry collects logs, events and the software inventory; ARX Horizon enriches every event with threat lists; ARX Trace runs collections and searches across multiple machines to check for suspicious traces; ARX Shield isolates a compromised machine from the network.

Last updated: 19 October 2026