Critical Adware Vulnerability Lets Attackers Infect Devices With Spyware

Key Takeaways

• A new zero-click spyware delivery method, dubbed “AdFection,” has been uncovered, leveraging targeted online advertisements to infect devices.
• The Israeli firm Discover-Tech facilitated this attack, linking the ad market to commercial spyware vendors like Candiru (now Integrity Labs).
• At least 45 devices belonging to international news network Al Jazeera were compromised with Candiru spyware between 2024 and 2025.
• The vulnerability highlights critical security gaps in the digital advertising ecosystem, where merely viewing an ad can lead to infection without user interaction.
• Major ad platforms, including Google, have removed Discover-Tech following the revelations.

Sophisticated Zero-Click Spyware Infiltrates Devices Via Online Ads

A groundbreaking investigation by Citizen Lab has revealed “AdFection,” a novel zero-click method allowing powerful spyware to infect devices simply by displaying a targeted online advertisement. This technique bypasses traditional user interaction requirements such as clicking on a malicious link or downloading a file, presenting a significant shift in the threat landscape.

The research provides the first public technical documentation of mercenary spyware delivered through this insidious mechanism. The primary victim identified was the international news network Al Jazeera, where at least 45 devices were compromised with spyware linked to the Israeli vendor Candiru, which now operates as Integrity Labs.

Citizen Lab’s findings, published on October 15, 2026, detail how the attack unfolded during 2024 and 2025. Network logs from infected Al Jazeera systems indicated an initial connection to Discover-Tech infrastructure immediately after an advertisement was rendered. This was followed by communication with a Candiru validation server, which assessed the device, and subsequently, a command-and-control server used by the spyware.

Discover-Tech: The Conduit for Spyware Delivery

Discover-Tech, an Israeli company portraying itself as an advertising business, was identified by Citizen Lab as a crucial intermediary between the online ad market and various commercial spyware groups. Their “Controlium” platform reportedly enabled clients to target individuals using mobile advertising IDs, browser cookies, and IP addresses.

The AdFection method exploited the inherent complexities of modern digital advertising. When an ad loaded on a target device, embedded code within the advertisement could establish contact with a Discover-Tech server. This server would then determine if the visitor matched a pre-selected target profile. If a match occurred, the server would deliver JavaScript that initiated further code loading and the infection process, all without requiring any user click or interaction.

This zero-click capability is possible because contemporary advertisements are no longer static images or videos. They frequently incorporate complex code for analytics, user tracking, and dynamic content loading from third-party sources. Real-time bidding (RTB) systems, which process vast amounts of user data in milliseconds to determine ad placements, provided a fertile ground for AdFection. This data, often including device IDs, IP addresses, location, and browser specifics, allowed AdFection to precisely identify and deliver malicious code only to specific targets, thereby evading detection by both ad platforms and security researchers.

Scale and Scope of the Operation

While the confirmed infections at Al Jazeera are significant, the overall scale of Discover-Tech’s operations was far broader. Researchers analyzed approximately four billion Discover-Tech bidding records spanning four months in 2026. These records revealed that the company’s advertisements appeared on nearly 200,000 unique websites and Android/iOS applications across dozens of countries. Millions of devices were also silently directed towards Candiru-linked servers, likely for reconnaissance and profiling before potential targeting. It is important to note, however, that merely viewing a Discover-Tech ad does not equate to infection, as most viewers were not selected to receive the spyware payload.

Investigators successfully recovered a Windows DLL from a compromised device, which was confidently attributed to Candiru. This sample employed COM hijacking for persistence and utilized a distinct 48-byte repeating XOR method to obfuscate strings. It also contained two command-and-control domains and exhibited behavioral characteristics consistent with earlier Candiru toolchains.

The SHA-256 hash of the recovered sample is 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8.

Citizen Lab also connected Discover-Tech to other entities, including Intelos and Bindecy. Furthermore, a separate actor, referred to as DARK CARTOGRAPHER, reportedly exploited the same infrastructure to correlate advertising IDs with phone numbers by abusing vulnerabilities within mobile carriers. This activity could potentially de-anonymize advertising profiles, linking them to real-world identities. Citizen Lab has indicated plans to release additional technical findings regarding this operation in a forthcoming report.

Industry Response and Future Implications

These revelations raise serious concerns about the efficacy of security vetting within the digital advertising industry. Discover-Tech had previously been listed as an approved or certified vendor and had served advertisements through major networks, including Google, Yandex, and Beeswax. Following the disclosure of Citizen Lab’s findings, Google promptly removed Discover-Tech from its advertising platforms. IAB Europe also suspended Discover-Tech from its approved vendor list, while Beeswax removed the company from its platform. Vungle paused access, and Eskimi blocked related accounts and domains.

The AdFection method fundamentally alters the risk profile associated with online advertising. Victims may become compromised without any action beyond simply opening a legitimate webpage or application. The confirmed infections at Al Jazeera underscore how targeted advertising can be weaponized into a sophisticated spyware delivery mechanism, and the extensive reach of these ads highlights a systemic issue extending far beyond a single news organization.

What You Should Do

• Block Known Infrastructure: Implement blocks for known Discover-Tech and Candiru infrastructure within your network security solutions.
• Inspect Ad-Related Traffic: Monitor network traffic for unusual or suspicious connections originating from ad-related domains or third-party scripts.
• Limit Advertising IDs: Restrict the use and sharing of advertising IDs on devices within your organization.
• Use Trusted Ad Blockers: Deploy reputable ad-blocking solutions to minimize exposure to potentially malicious ad content.
• Browser Isolation: For sensitive tasks or networks, consider using browser isolation technologies to contain potential threats.
• Strict Script Controls: Implement stringent controls over third-party scripts allowed to execute on your systems.
• Reset Mobile Advertising IDs: Regularly reset mobile advertising IDs on personal devices and disable personalized ads where possible.
• Advocate for Industry Change: Urge advertising companies to enhance vendor vetting processes, rigorously scan ad code, share threat intelligence, and prevent unvetted third parties from executing code without thorough review.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.