- Researchers at Citizen Lab and Confiant uncovered ‘AdFection,’ a stealth attack vector weaponizing programmatic ads to deliver zero-click spyware.
- Israeli adtech company Discover-Tech functioned as a bridge for surveillance vendor Candiru, compromising dozens of devices at Al Jazeera.
- Discover-Tech was listed as an approved vendor by Google and IAB Europe since 2020 before industry partners severed ties following the report.
AdTech Weaponized: Unmasking the AdFection Technique
Digital rights watchdog Citizen Lab, operating out of the University of Toronto, in partnership with cybersecurity firm Confiant, has documented the first confirmed zero-click commercial surveillance campaign delivered entirely through targeted online ads. Dubbed “AdFection”, the technique transforms conventional web advertising exchanges into a stealth delivery pipeline for state-sponsored spyware.
Unlike traditional phishing campaigns that rely on social engineering, malicious links, or malicious downloads, AdFection requires zero interaction from the target. The malicious payload executes automatically the moment an advertisement loads inside a browser or an integrated mobile application—often triggering in the background entirely out of the user’s view.
The Discover-Tech and Candiru Pipeline
According to researchers, the campaign relied on Israeli adtech entity Discover-Tech. While operating outwardly as a legitimate programmatic marketing business, Citizen Lab concluded that Discover-Tech served as a critical intermediary connecting mainstream digital ad exchanges with commercial spyware vendors, notably Candiru (currently known as Integrity Labs).
Discover-Tech leveraged its proprietary Controlium platform to exploit the real-time bidding (RTB) architecture. During standard RTB auctions, advertisers receive precise telemetry about the visitor, including location data, operating system, and hardware identifiers. Discover-Tech allegedly harnessed these real-time signals to pinpoint predefined targets and serve weaponized advertising units.
Scope and Documented Incidents
Technical telemetry gathered during the investigation outlined the footprint of the campaign:
| Parameter | Investigation Findings |
|---|---|
| Primary Confirmed Target | Al Jazeera media network |
| Verified Compromises | At least 45 devices infected during 2024 and 2025 |
| Delivery Footprint | Over 70,000 mobile applications and 120,000 websites |
| Analyzed Bid Data | Nearly 4 billion real-time bidding records |
| Monitored Networks | Government departments, defense bodies, and NATO facilities |
Industry Fallout and Structural Vulnerabilities
The findings emphasize severe vetting blind spots within ad supply chains. Discover-Tech operated with verified credentials as an approved partner of Google and IAB Europe since 2020. Between March and June 2026, millions of end-user devices were covertly routed toward servers tied to Candiru infrastructure.
Following notifications from Citizen Lab, Google terminated Discover-Tech’s access to its ad exchanges and purged the firm from vetted vendor registries. IAB Europe, along with ad networks Beeswax, Vungle, and Eskimi, similarly cut ties. Neither Discover-Tech nor Candiru responded to inquiries regarding the findings.
The deployment of zero-click payloads through legitimate ad bidding reveals a structural risk in programmatic digital advertising. Standard RTB data harvesting provides surveillance vendors with precise recon tools. For high-risk organizations, journalists, and enterprise environments, robust network-level ad-blocking (DNS sinkholing) and disabling untrusted in-app web views have shifted from privacy preferences to essential cybersecurity defenses.
Weaponizing the RTB protocol transforms standard programmatic ad exchanges into an unprecedented threat vector. By exploiting bidstream metadata for deterministic targeting, threat actors have completely bypassed browser sandboxing at scale. DSPs and exchanges must urgently implement rigorous payload verification and cryptographic attestation to patch these systemic supply-chain vulnerabilities.