Citizen Lab Uncovers AdFection Pipeline Targeting Global Entities
Targeted Online Ads Weaponized for Zero-Click Spyware Attacks
- Discover-Tech turns targeted ad auctions into zero-click spyware delivery networks
- At least 45 Al Jazeera devices compromised with Candiru surveillance malware
- Ad vectors detected across networks of NATO, United Nations, and Nvidia
A groundbreaking investigation by Citizen Lab at the University of Toronto has exposed a novel cyber-surveillance technique termed "AdFection", which leverages real-time digital advertising networks to deliver zero-click spyware directly to targeted mobile and desktop devices. The infrastructure is facilitated by Discover-Tech, an Israeli ad-tech entity that operated ad-bidding operations to run mass profiling and targeted exploitation globally.
According to Citizen Lab's report published on October 15, 2026, Discover-Tech's ad targeting platform was actively used to compromise at least 45 devices belonging to media personnel at Al Jazeera. The breaches were validated through detailed network log analysis provided by the broadcaster.
The Guardian reported that Discover-Tech operates a control-panel interface named 'Controlium'. Controlium enables clients to track, de-anonymize, and profile web users, subsequently deploying payload scripts that initiate zero-click infections in tandem with mercenary spyware vendor Candiru. Unlike conventional phishing attacks, AdFection requires no user interaction or link clicking; the device is infected silently within milliseconds as the advertisement renders in an app or browser background.
Researchers highlighted that the online ad ecosystem has been systematically weaponized. Masquerading as ordinary mobile gaming or utility ads, Controlium scripts extract device IP addresses and hardware fingerprints. Between 2024 and 2026, these malicious ad bids generated hundreds of millions of impressions globally, spanning users in Yemen, Brazil, Mexico, and the Czech Republic.
Ad-threat intelligence firm Confiant further revealed that Discover-Tech's ad bids successfully reached secure networks belonging to international bodies, including the United Nations, NATO, the European Commission, the International Criminal Court (ICC), and the International Atomic Energy Agency (IAEA). The ads were also served on internal networks of major technology firms such as Nvidia, SanDisk, and Broadcom. Following the disclosures, major ad platforms including Google, Beeswax, and Eskimi terminated Discover-Tech's account access.
Bill Marczak, Senior Researcher at Citizen Lab, stated that while rumors of ad-based targeting and automated exploitation had circulated for years, this investigation marks the first concrete technical proof demonstrating the mechanism in action. Wolfie Christl, Senior Researcher at Citizen Lab, emphasized that the architecture of today's online ad industry presents a systemic security threat to states, civil society, and private sector enterprises, calling for urgent intervention by cybersecurity agencies and international regulators. Discover-Tech and Candiru's parent entities did not respond to requests for comment.
//DBTech/CitizenLab/SMP/MIST//
