Ad-Injection Campaign Leverages Real-Time Bidding to Deliver Candiru Spyware
A sophisticated espionage campaign, identified as “AdFection,” has been uncovered, revealing how a seemingly legitimate advertising entity served as a delivery mechanism for high-end, zero-click spyware. The operation, which targeted high-profile entities including the international news organization Al Jazeera, utilized the global Real-Time Bidding (RTB) advertising ecosystem to fingerprint, track, and ultimately compromise targeted devices.
The Mechanics of AdFection
The campaign centers on the activities of an Israeli firm, Discover-Tech, which operated the “Controlium” platform. According to research, this platform functioned as a bridge between the legitimate digital advertising market and mercenary spyware vendors, specifically the Israel-based firm Candiru. By participating in the massive, automated auctions that govern online advertising, Discover-Tech was able to inject malicious scripts into ads displayed on websites and mobile applications globally.
These scripts were designed to perform device fingerprinting and de-anonymization, identifying specific users based on parameters like IP addresses and advertising identifiers. Once a target was identified, the platform facilitated a zero-click infection chain, allowing the deployment of Candiru’s spyware directly onto the victim’s device without any user interaction. Evidence suggests this operation was not isolated; researchers identified a server linked to Discover-Tech that exposed approximately four billion ad bid records, highlighting the scale of the infrastructure used to monitor and target users across nearly 200,000 unique web and application domains.
Broader Implications for Digital Surveillance
The investigation into AdFection also highlighted the convergence of digital marketing infrastructure and state-sponsored surveillance. Discover-Tech allegedly collaborated with other entities, such as the “Dark Cartographer” group, which has been linked to efforts to map mobile advertising identifiers to actual phone numbers by exploiting vulnerabilities within mobile carrier networks. This level of integration demonstrates a significant evolution in how threat actors leverage existing internet infrastructure to bypass traditional security controls.
Between 2024 and 2025, at least 45 devices belonging to Al Jazeera personnel were confirmed to have been targeted by this vector. The ability to weaponize the RTB ecosystem—a cornerstone of modern web monetization—presents a unique challenge for security teams, as the malicious activity is often indistinguishable from standard advertising traffic until the moment of exploitation.
Defensive Recommendations
In response to the discovery of the AdFection campaign, major ad exchanges, including Google, have taken steps to remove Discover-Tech from their vendor registries and block its access to ad platforms. However, experts warn that the underlying threat remains significant. Given the nature of the delivery mechanism, researchers suggest that the most effective immediate defense for organizations is to implement robust blocking of targeted advertising at the network gateway. This approach minimizes the risk of exposure to malicious scripts that rely on external ad-serving infrastructure to initiate the infection process.
As mercenary spyware vendors continue to find innovative ways to exploit the digital ecosystem, security professionals are encouraged to maintain a posture of strict network egress filtering and to remain vigilant against the potential for “malvertising” to serve as a conduit for advanced persistent threats.
