Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports.
As part of the operation, dubbed AdFection, ads purchased by Israeli company Discover-Tech were used to de-anonymize, fingerprint, and infect users, and also allow threat actors to track millions of devices.
As part of the online advertising ecosystem, companies bid at billions of daily Real-Time Bidding (RTB) auctions hosted on ad exchanges for a chance to serve an ad to a user.
Ad exchanges collect extensive device and user data that enables tracking, and ads may contain code that runs in the user’s application or browser, typically for tracking users, impressions, and clicks.
However, ads may also contain malicious code potentially leading to malware infections and, courtesy of the various identifiers used within the ecosystem, could be used to target specific individuals with spyware, Citizen Lab says.
Discover-Tech, a seemingly legitimate advertising company, is likely the front for a large campaign involving spyware infection and espionage, serving as a bridge between ad vendors and mercenary spyware vendors.
Its Controlium platform enables the de-anonymization of millions of users, device fingerprinting, and zero-click hacking when an ad is displayed on the victim’s device.
While the company appears to work with multiple mercenary partners, Citizen Lab has confirmed its use to profile users and infect them on behalf of Candiru, an Israel-based spyware vendor.
Many of Discover-Tech’s ads contain a script that automatically connects to its infrastructure, submits an advertising ID for the user, and executes JavaScript code served based on a combination of IP addresses and identifiers.
Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in AdFection attacks leading to Candiru’s spyware.
Citizen Lab says it identified a Discover-Tech server that exposed four billion ad bid records, revealing that Discover-Tech’s ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide.
Citizen Lab, which has extensively detailed Discover-Tech’s Controlium platform, Candiru’s AdFection attacks, and Discover-Tech’s ad deployment mechanism, also analyzed Discover-Tech’s interaction with other surveillance threat actors.
One of these, Dark Cartographer, is “building databases linking users’ mobile advertising identifiers to their phone numbers” by exploiting vulnerabilities across various mobile carriers, mass-deanonymizing internet users, Citizen Lab says.
In early October, Google and IAB Europe removed the company from their ad vendor registries, Google blocked Discover-Tech’s access to its ad exchange platforms, and Beeswax and Eskimi took similar measures.
“Given the current threat posed by Discover-Tech’s AdFection vectors, and the evidence of wide-scale targeting, we judge that the most feasible protection is for defenders to block targeted ads at the gateway. This defensive recommendation holds until the industry has shown that it is reliably able to block all AdFection-style vectors,” Citizen Lab notes.
Related: WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order
Related: Hacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in Warfare
Related: ‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors
Related: New ‘ZeroDayRAT’ Spyware Kit Enables Total Compromise of iOS, Android Devices
