ADFECTION is a newly described technique in which spyware operators weaponise the online advertising ecosystem to deliver covert malware without any user interaction. Researchers from the University of Toronto’s Citizen Lab describe how an Israeli ad-tech company, Discover-Tech, allegedly used this approach to help the spyware vendor Candiru (now Integrity Labs) infect devices via targeted ad campaigns.
In the identified operation, the attack chain begins when a bid wins in a real-time bidding auction, prompting an advertisement to render on a website or app. A tag embedded in the ad then contacts Discover-Tech servers, supplying device identifiers. If the device matches predefined targeting criteria, the server returns JavaScript that can execute within the user’s browser or app, enabling a zero-click infection pathway.
Citizen Lab’s evidence logged infected devices contacting Discover-Tech infrastructure, Candiru validators, and ultimately a Candiru command-and-control server, with Al-Jazeera personnel purportedly affected in at least one case.
The investigation highlights Controlium, Discover-Tech’s platform for configuring campaigns using IPs, cookies, and mobile advertising IDs to de-anonymise and fingerprint targets. Citizen Lab found that nearly 200,000 unique websites and apps across dozens of countries were shown targeted ads during a four-month window, with victims spanning government, military, critical infrastructure, media, and multilateral organisations.
The report notes that ad impressions alone cannot prove targeting or infection, but the researchers call for urgent safeguards across the online advertising ecosystem. Following disclosure, Google and several ad-tech platforms moved to cut Discover-Tech’s access, and IAB Europe removed the company from registries, underscoring the industry‑level implications of AdFection.