Citizen Lab researchers have documented real-world attacks in which mercenary spyware reached targets through targeted online ads without any click, a technique they call AdFection. The lab described its report as the first public technical confirmation of spyware delivered this way. Al Jazeera supplied evidence of the attacks, which targeted at least 45 devices between 2024 and 2025. The campaign was tied to the Israeli firm Discovere-Tech.
Citizen Lab described Discovere-Tech as a bridge between mercenary spyware companies and the advertising ecosystem. The lab said the company let customers use its Controlium platform to aim malicious code at specific devices or to profile, de-anonymize and fingerprint them. Discovere-Tech appears to work with multiple spyware, hacking and advertising vendors, according to the lab. The company bought ad placements through mainstream ad networks and exchanges and embedded JavaScript in ads that contacted its NOAS server, also called the getAd server, when they rendered.
That server weighed parameters including IP address and ad identifiers to decide whether a device should receive extra JavaScript. Selected targets got the additional code, while other devices where the ad appeared received nothing, which helped keep the operation quiet. Network logs reviewed by the researchers showed a path from Discovere-Tech infrastructure to Candiru validation servers and on to spyware command-and-control servers. The researchers also recovered a DLL file from an infected Windows machine and attributed it to Candiru with high confidence, citing infrastructure and code overlaps with earlier samples.
Candiru is an Israeli vendor that sells surveillance tools, officially only to governments. The company developed Windows malware called DevilsTongue that can take files, credentials and messages. Past reports have described its tools being used through Windows and Chrome zero-day exploits against journalists, activists, politicians and other targets.
A similar ad-based method was documented in late 2025 by Amnesty International, using ads that infected targets with Predator spyware without a click. That mechanism was called Aladdin and came to light through a collection of marketing files and documents leaked from the surveillance company Intellexa, which researchers studied and corroborated with technical details from forensic investigations. AdFection, by contrast, was caught in actual attacks.
Citizen Lab reported that the advertising operation placed 3.77 billion bids and won 442 million auctions between March and June 2026. Ads assessed to carry attacker script tags appeared across 75,373 Android and iOS apps and 120,768 websites, though those figures do not represent infection counts. The lab estimated that between hundreds of thousands and millions of users were directed to the domains through Discovere-Tech ads. After receiving the reports, Google, IAB Europe, Beeswax, Eskimi and Vungle removed offending accounts and blocked access to the domains.
More cybersecurity news from TechManNews.
