" a bridge between mercenary spyware companies and the advertising ecosystem," Citizen Lab says.
AdFection: zero-click delivery through targeted ads
Researchers at Citizen Lab describe a zero-click infection technique they named AdFection, in which targeted online advertisements delivered Candiru spyware to devices simply by rendering the malicious ads. AdFection required no user interaction beyond loading an ad: the ad's embedded JavaScript contacted a Discover‑Tech "NOAS server" and, when the server identified a target, additional malicious code was served.
Discover‑Tech, Controlium and the NOAS/getAd validation flow
Citizen Lab links the operation to Discover‑Tech, which offered a Controlium platform enabling customers to target specific devices, profile, de‑anonymize, and fingerprint user devices. Discover‑Tech purchased placements through mainstream ad networks and exchanges and embedded JavaScript in ads that contacted its NOAS server — also described as a "getAd server" — whenever the ad was rendered. The NOAS server used multiple parameters, for example IP address and ad identifiers, to determine eligibility; devices selected by those checks received additional code while other devices received nothing, a design intended to preserve stealth.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTrace evidence: Al Jazeera logs, DLL recovery, and Candiru servers
Citizen Lab examined evidence provided by Al Jazeera Media Network showing attacks that targeted at least 45 devices between 2024 and 2025. Network logs demonstrated a sequence from Discover‑Tech infrastructure to Candiru validation servers and then to spyware command‑and‑control servers. The researchers also recovered a DLL from a compromised Windows system and attributed it with high confidence to Candiru based on infrastructure and code overlaps with previously captured samples.
Scale: billions of bids, hundreds of millions of wins, wide ad placement
Between March and June 2026 the advertising operation placed 3.77 billion bids and won 442 million auctions, according to Citizen Lab's analysis. Ads carrying attacker script tags appeared across 75,373 Android and iOS apps and 120,768 websites — figures that reflect placement breadth rather than confirmed infections. Citizen Lab estimated that "between hundreds of thousands and millions of users were directed to these domains via Discover‑Tech ads."
How advertising companies and others responded
Following Citizen Lab's disclosures, major advertising companies and industry bodies took action: Google, IAB Europe, Beeswax, Eskimi, and Vungle removed offending accounts and blocked access to implicated domains. Citizen Lab contrasts the visible mitigation steps with an operational reality noted elsewhere in the reporting: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply."
What this means for technologists, policymakers, and media organizations
- Technologists and security teams: monitor ad network traffic and ad‑delivered JavaScript that calls unfamiliar NOAS/getAd domains; investigate server flows that validate devices and subsequently reach validation or command‑and‑control servers, given Citizen Lab's observed chain from Discover‑Tech to Candiru servers.
- Policymakers and regulators: note that mainstream ad exchanges and networks were used to acquire placement at scale; the public removal actions by Google, IAB Europe, Beeswax, Eskimi, and Vungle show one enforcement path but also illustrate how ad infrastructure can be leveraged to reach large populations quickly.
- Media organizations and journalists: Al Jazeera's logs show news organizations can be specific targets; recovered artifacts — including a DLL attributed to Candiru — underscore that zero‑click ad delivery can lead to full compromise on Windows systems.
The Citizen Lab report is the first public technical confirmation, the researchers say, of mercenary spyware being delivered through targeted ads. Amnesty International had earlier described a similar mechanism in late 2025 — named Aladdin — involving Predator spyware, but Citizen Lab's work ties AdFection to real, observed attacks and to Discover‑Tech's role in the advertising ecosystem. The immediate question the record now poses is operational and structural: how will ad networks and buyers detect and prevent scripted validation flows that selectively arm a tiny fraction of impressions, while leaving the bulk of placements looking ordinary?
