Citizen Lab documents Discover-Tech Controlium platform delivering Candiru zero-click spyware through ordinary targeted ads to Al Jazeera devices

[u/CollapsingTheWave]

Citizen Lab’s October 15, 2026 report describes AdFection as the first publicly confirmed case of zero-click mercenary spyware delivered by targeted online advertisements. Discover-Tech, an Israeli firm presenting itself as a digital advertising company, operates the Controlium platform that bids in real-time auctions, receives device identifiers and IP addresses when an ad renders, and can then redirect selected devices to exploit servers. Network logs from Al Jazeera showed the sequence on at least 45 Windows computers in 2024 and 2025: an ad impression from Discover-Tech infrastructure, a Candiru validator check within seconds, an exploit server, and command-and-control traffic. Candiru (rebranded Integrity Labs) was previously placed on the U.S. Commerce Department Entity List for spyware used against journalists, officials, and others. Controlium is also linked to Bindecy and Intelos.

Analysis of roughly four billion Discover-Tech bidding records from March to June 2026 showed the company bid on 3.77 billion impressions and won about 442 million. Ads carrying attacker script tags appeared in 75,373 Android and iOS apps and on 120,768 websites, including Viber, Duolingo, Yahoo Mail, Grindr, and Badoo, as well as sites such as the BBC, New York Times, and CBC. Millions of devices were directed to contact Candiru-linked servers for profiling or reconnaissance; only selected targets received the infection payload. Discover-Tech appeared on certified or approved vendor lists maintained by Google and IAB Europe and served ads through Google, Yandex, and Beeswax. The company exploited GDPR consent frameworks to reach users in the European Union. No evidence of ordinary advertising activity was found.

Citizen Lab previously documented Candiru spyware infections in 2021. The October 2026 report shows the same vendor’s tools delivered through the advertising ecosystem rather than through direct zero-click vectors alone. Discover-Tech’s corporate ties include past board members and shareholders connected to Circles, Senpai Technologies, and the Intellexa network. A separate actor labeled DARK CARTOGRAPHER used Discover-Tech infrastructure to link advertising IDs with phone numbers via mobile carrier vulnerabilities; Citizen Lab stated a follow-up report is forthcoming. After disclosure, Google, IAB Europe, Beeswax, Vungle, and Eskimi suspended or removed Discover-Tech’s access.

Ordinary ad rendering now serves as a delivery path for state-grade spyware without user interaction. The real-time bidding system broadcasts device identifiers and network data to any participating bidder, and vendor certification processes did not detect Discover-Tech’s dual role. At least 45 Al Jazeera devices were infected; millions more were profiled. Regulatory and platform responses consisted of post-disclosure suspensions by several ad networks. Citizen Lab called for regulators to examine whether Discover-Tech and Candiru/Integrity Labs violated applicable laws and recommended changes to ad auction controls, vendor vetting, and exploit detection.

Sources

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

Exposing AdFection Executive Summary

https://citizenlab.ca/research/exposing-adfection-executive-summary/

No click required: How the ad industry became a pipeline for mercenary spyware

https://www.csoonline.com/article/4236143/no-click-required-how-the-ad-industry-became-a-pipeline-for-mercenary-spyware.html

AdFection Attack Hid Zero-Click Spyware Inside Online Ads

https://www.cyberkendra.com/2026/10/adfection-discover-tech-candiru-spyware-ads.html

AdFection Spyware: 45 Infections, Millions Profiled

https://readus247.com/adfection-spyware/

[u/CollapsingTheWave]

Citizen Lab’s October 15, 2026 report documents Discover-Tech’s Controlium platform using ordinary targeted ads to deliver Candiru zero-click spyware. At least 45 Al Jazeera Windows devices were infected in 2024–2025 after ads rendered and redirected selected machines to exploit servers. Bidding data covering 3.77 billion impressions showed the ads appearing across tens of thousands of apps and websites while millions of other devices were profiled. Several ad networks suspended Discover-Tech after disclosure.

[u/tonkatoyelroy]

What countries make the most spyware?

[u/Londonskaterboi]

pihole finally paying off

[u/Conscious_Arrival635]

Israel at it again huh

[u/dad_jokesNbutt_stuff → u/Conscious_Arrival635]

I’m learning that it has never stopped.

[u/Theidiotshvtakenovr]

Correct me if I am wrong but I believe the exploit lives in the memory and not on the physical device. Turning the phone off and back on can clear the attack. Lockdown mode also prevents this if you have iPhone. If they payload malware or rootkit you - get a new phone lol. 

Isn’t he just basically describing Pegasus?