Israeli Ad Firm Used for Candiru Spyware Delivery
A new investigation reveals how an Israeli advertising company operated as a pipeline for zero-click spyware infections, targeting devices globally through programmatic ad networks.
Radwan AbdulhadiEditor and technology writer
The AdFection Operation and Discover-Tech
According to a recent report by Canadian internet watchdog group Citizen Lab, an Israeli advertising company named Discover-Tech functioned as a front for espionage and malware distribution. The operation, designated as AdFection, utilized targeted digital advertisements to de-anonymize, fingerprint, and infect user devices with spyware. Further details on the mechanics of this operation can be found in the comprehensive [AdFection](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) research paper.
In the modern online advertising ecosystem, technology companies participate in billions of daily Real-Time Bidding (RTB) auctions hosted on ad exchanges to serve advertisements to users. While ad exchanges collect extensive device and user data for tracking impressions and clicks, these same mechanics can be subverted. Citizen Lab notes that malicious code hidden within ads can lead to device compromises, allowing threat actors to target specific individuals using identifiers inherent to the ecosystem.
Controlium Platform and Candiru Spyware Integration
Discover-Tech's Controlium platform enabled the mass de-anonymization of millions of users, precise device fingerprinting, and zero-click hacking executed the moment an advertisement loaded on a victim's device. Although the firm reportedly engaged with multiple surveillance partners, Citizen Lab explicitly confirmed its role in profiling and infecting targets on behalf of [Candiru](https://www.securityweek.com/?s=Candiru), an Israel-based mercenary spyware vendor.
Many advertisements deployed by Discover-Tech contained automated scripts designed to connect directly to the company's infrastructure. These scripts submitted user advertising identifiers and executed JavaScript code tailored based on a combination of IP addresses and device identifiers.
Global Scope and Al Jazeera Targeting
The investigation revealed a significant breadth of exposure. Citizen Lab identified a Discover-Tech server that inadvertently exposed four billion ad bid records. This data indicated that Discover-Tech's advertisements had appeared across nearly 200,000 unique websites as well as mobile applications on Android and iOS platforms worldwide.
Among the specific targets identified in the campaign were personnel at the international news network Al Jazeera. Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted in AdFection attacks that resulted in successful infections with [Candiru](https://www.securityweek.com/?s=Candiru) spyware.
Broader Surveillance Ecosystem and Industry Response
In addition to its work with [Candiru](https://www.securityweek.com/?s=Candiru), Citizen Lab analyzed Discover-Tech's interactions with other surveillance entities. One such actor, identified as Dark Cartographer, has been building databases that link mobile advertising identifiers directly to phone numbers by exploiting vulnerabilities across various mobile carriers.
Following the disclosure of these findings in early October, major technology companies and industry bodies took swift action. Google and IAB Europe removed Discover-Tech from their ad vendor registries, while Google blocked the company's access to its ad exchange platforms. Similar punitive measures were enacted by Beeswax and Eskimi.
Defensive Recommendations for Network Operators
Due to the persistent threat posed by the AdFection vectors and evidence indicating widespread targeting, researchers have issued clear defensive guidance. Citizen Lab recommends that network defenders block targeted advertisements directly at the gateway to mitigate risks until the advertising industry demonstrates a reliable capability to eliminate all AdFection-style delivery vectors.
The discovery underscores the ongoing challenges within programmatic advertising networks, where automated bidding mechanisms designed for marketing can be repurposed by mercenary spyware vendors to conduct stealthy cyberespionage operations.
Sources
- SecurityWeekIsraeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Continue chronologically
Related entity coverage
Related stories
Targeted Ads Delivered Zero-Click Exploits for Spyware
Researchers reveal that mercenary hackers laced targeted ads with zero-click exploits to install sophisticated spyware on devices without user interaction.
Targeted Ads Delivered Candiru Spyware in Zero-Click Attacks
Researchers reveal zero-click attacks targeting Al Jazeera devices by delivering Candiru spyware through targeted online advertisements.
SS7 and Diameter Flaws Expose Mobile Networks
Explore how vulnerabilities in SS7 and Diameter signaling protocols allow attackers to track phone locations, intercept calls, and bypass 2FA.
Android November 2026 Updates Patch Over 200 Vulnerabilities
Google has announced its November 2026 security updates for Android, addressing over 200 vulnerabilities, including a critical remote code execution flaw.
