AdFection: How Targeted Online Ads Became a Zero-Click Spyware Delivery Vector

The page load that ends in compromise

The attack starts with a page load. An article opens, an ad slot fills, the creative renders, and for nearly every viewer nothing else happens. For a small number of people selected in advance, the same render starts a chain of network requests that ends, minutes later, with mercenary spyware talking to its operator. On October 15, 2026, the University of Toronto’s Citizen Lab, working in parallel with the ad-security company Confiant, published that chain in full and named it AdFection. It is the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertisements in real-world operations.

The case behind the name is an espionage campaign against Al Jazeera. Across 2024 and 2025, Citizen Lab found with high confidence that devices at the international news network were targeted and infected with spyware from Candiru, the Israeli surveillance vendor blacklisted by the U.S. Commerce Department in 2021 and reportedly now owned by the U.S.-based Integrity Labs. At least 45 devices within the broadcaster were targeted. Network logs that Al Jazeera handed to Citizen Lab give the report an unusually concrete timeline: first contact with Discover-Tech advertising infrastructure, then a connection to a Candiru validator server, and finally, on devices that got that far, command-and-control traffic to Candiru servers.

Classic malvertising depends on clicks, redirects and scam landing pages, so it depends on human error. AdFection’s delivery path executes code as a consequence of the ad rendering, and whether anything happens is decided server-side, per device, per impression. The visible creative doesn’t need to look hostile. Security training built around suspicious links and attachments does nothing against an attack where the target only read a page.

The company in the middle: Discover-Tech and Controlium

Citizen Lab’s report centers on Discover-Tech, an Israel-based firm that presented itself as a digital advertising business. The researchers found no evidence that it was engaged in legitimate advertising activity at all. What it operated was Controlium, a platform described as a one-stop interface for mercenary spyware firms. Controlium could mass-profile and deanonymize users at advertising scale, then direct zero-click exploits at individual devices by sending them seemingly benign ads. Citizen Lab’s reconstruction of its user base includes Candiru, Bindecy and Intelos, the latter an advertising-intelligence (ADINT) firm synonymous with geolocation tracking. Confiant’s parallel investigation found shared GitHub repositories, overlapping infrastructure with connected entities such as Volasim and MyIpInfo, and a creative mix that looked nothing like a real advertising business. The Record’s coverage describes the platform’s spyware clients gaining capabilities such as recording calls, turning on microphones and siphoning messages and emails.

In most malvertising, the ads are the business. Here they were the cover. Roughly 60 percent of the creatives Confiant observed moving through Discover-Tech’s stack in August 2026 were affiliate placements running borrowed brand imagery, and more than a third of the company’s ad spend went toward promoting MyIpInfo, a free IP-lookup website with no visible monetization. Buying that volume on premium inventory to distribute affiliate links makes no sense as a profitable media business. At peak, Confiant estimates, Discover-Tech’s pipes carried on the order of ten million ad impressions per day.

How the advertising supply chain became an attack surface

Start with the route an impression normally takes. When a person opens a monetized website or application, the publisher’s software requests an ad. A supply-side platform packages the inventory, an ad exchange runs an auction in milliseconds, and demand-side platforms bid on behalf of advertisers. The winning creative is returned and rendered in the user’s browser or app. The same architecture makes the ecosystem a rich surveillance environment. Data about identity, device, location, web and app usage, habits, interests and demographics flows from the user’s environment to multiple parties in the chain, while third-party code embedded in the page measures impressions, facilitates delivery and tracks clicks. Ad exchanges and SSPs are frequently operated by the same company, so the separation between sell side and buy side is thinner than the architecture diagram suggests.

AdFection exploits two properties of this design. First, an ad creative is a program: a bundle of HTML, JavaScript, tracking pixels and references to remote resources that keeps making network requests after it renders. Second, a real-time bidding request already carries enough identifier material, from cookie IDs and mobile advertising IDs to IP addresses and device characteristics, for a bidder to recognize a specific device rather than a demographic segment. Combine the two and an advertiser with exchange access can ask a question no legitimate campaign needs to ask: is this exactly the person I want, and if so, what should their device execute next?

Programmatic advertising’s accountability structure makes that question hard for anyone else to notice. A publisher knows its SSP but not every downstream bidder. An exchange sees a plausible auction but not what a remote server returns after rendering. A creative-review process inspects what was submitted, not how the submitted code behaves for a chosen subset of viewers. Citizen Lab describes the NOAS server, Discover-Tech’s so-called getAd server, as the hinge of this evasion. The ad merely contains a script tag that phones home and automatically executes whatever JavaScript comes back, so Discover-Tech never had to share malicious code, or even pointers to it, with the companies that served and displayed the ads.

The infection Chain, second by second

The report’s timeline, reconstructed from Al Jazeera’s logs, runs as follows. At zero seconds the creative renders and pulls its images and scripts from Discover-Tech-controlled infrastructure, including a cloud-images.s3.eu-west-1.amazonaws[.]com bucket and noas.mtrtb[.]com. Within one to two seconds the embedded script contacts the NOAS server and submits the device’s advertising identifier, either a cookie ID or a mobile ad ID, along with whatever else the request context exposes, such as the source IP address. The server then decides. For anyone who is not a target it returns a zero-byte response and the ad behaves like an ad. For a matched device it returns JavaScript that executes automatically in the ad frame.

That script does two things inside the same one-to-two-second window. It fetches a URL that submits impression analytics to dtech.adtimizer[.]co, traffic that is indistinguishable from ordinary ad measurement at a glance and that Confiant found also carried the creative’s device fingerprint and siphoned cookies. It also inserts a one-by-one-pixel iframe pointing at a Candiru validator server, keyadapter[.]com or sharethere[.]net in the documented campaign. An embedded document needs no visible area to make network requests, so validation proceeds invisibly. Citizen Lab fingerprinted these validators in internet-wide scanning data by their distinctive Apache banner structure, which is also how the researchers swept for related infrastructure. For the command-and-control servers used later in the chain, it developed a separate shared fingerprint, Fingerprint C1.

Between five and ten seconds after rendering, a device that passes validation is redirected toward the exploitation stage, brainsolitary[.]com in the Al Jazeera sequence. Zero-click here means the victim supplies no action: no tap, no download, no link. A vulnerability is still involved. The browser or webview has to process what it is given, and success depends on the exploit matching the target’s software environment, which is why the public report declines to pin a single CVE to every infection. The advertising layer supplies reach and selection. The exploit chain arrives automatically at a device the operator picked out of millions.

One to three minutes later, on devices where exploitation succeeded, the implant establishes its command-and-control channel. The C2 set documented in the campaign runs to seven domains: fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com, rebookings[.]net, freshmeditate[.]com and dustclimate[.]com. Four matched Fingerprint C1, and the other three left no response in scanning data. Confiant’s analysis of Discover-Tech’s SDK explains why the gap between rendering and beaconing can be so short. The SDK loops through device, network and behavioral fingerprinting while polling its operator’s server once per second, and it gives up after ten empty responses unless switched to a persistent transport. It can also compile and run arbitrary code pushed from the server inside a new Function() call, executed with whatever authority the ad frame holds.

What the Windows implant gave away

Attribution doesn’t rest on domains alone. Al Jazeera isolated a Windows DLL from a compromised device, and Citizen Lab published its SHA-256 hash, 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. Two C2 addresses were hardcoded inside it, fearevolve[.]com and jobmarcher[.]com, both matching Fingerprint C1. From there the analysis turned to behavior. The sample persists through COM hijacking, redirecting Windows’ Component Object Model resolution so that an attacker-controlled library loads in place of the expected one. That gives the implant a way to run again without requiring administrator-level theatrics.

The strings inside the DLL were obscured with a repeating XOR key of 48 bytes, weak cryptography by design but enough to defeat casual string extraction. Two quirks tied the sample to history. The obfuscated strings contained a dummy null-terminator character that the decryption routine never deobfuscates and silently discards, apparently only to force the right-sized memory allocation for the decoded output. And the configuration hardcoded an ordered connectivity-check list, http://www.google.com followed by http://www.microsoft.com. Citizen Lab had documented a Candiru toolchain in 2021. The older and newer samples use different DLLs for the COM hijack and different XOR keys, but the shared quirks, the shared technique and the matching connectivity behavior led the researchers to conclude with high confidence that the Al Jazeera DLL was a newer build of the same lineage.

Four billion records, and who was exposed

The Al Jazeera logs prove the chain can end in compromise. The bidding records show how wide the front end stretched. Citizen Lab found nearly four billion ad bidding records publicly exposed on a Discover-Tech website and analyzed the March-to-June 2026 slice. In that period the company’s ads appeared in more than 70,000 mobile apps and over 120,000 websites, on the order of 200,000 properties in dozens of countries. The impressions reach networks no advertising operation should casually touch: NATO and the United Nations; the European Parliament, the European Commission and the Council of the European Union’s General Secretariat; ministries of defense, armed forces, national cyber agencies and critical-infrastructure operators; and media organizations around the world. Confiant’s telemetry added further sensitive names, including the U.S. Department of Defense, Estonia’s Information System Authority, the International Atomic Energy Agency and the International Criminal Court.

Read these numbers with care, as the report itself does. The same device generates many requests, and most renders ended in nothing worse than measurement traffic, so a bidding record counts requests rather than people and exposure doesn’t mean compromise. Citizen Lab’s own formulation is that, at minimum, these impressions would have resulted in profiling by Discover-Tech, and in some cases they could have resulted in code from Candiru or other entities running on the user’s device. Even the minimum is a large surveillance fact, since profiling at this scale was half of the operation’s purpose.

The other half surfaces in a separate thread Citizen Lab calls DARK CARTOGRAPHER. Ads in the same ecosystem attempted to unmask users behind VPNs and proxies through the WebRTC IP-leak problem. They also tried to recover mobile subscribers’ phone numbers, technically the MSISDN, by abusing weaknesses in the zero-click login technologies built for frictionless authentication and purchases. Citizen Lab assesses that this actor has been exploiting MSISDN leak issues since at least 2019 behind a rotation of mercenary adtech fronts, and that its infrastructure links both a mercenary adtech vendor and a U.S. government contractor, an overlap the researchers call rare. A follow-up report is promised. The finding already stands on its own: advertising identifiers correlated with carrier-side identity data can deanonymize people without any malware being installed.

Why real-time bidding keeps producing this problem

Real-time bidding exists to price an impression in milliseconds, and to do that a bid request carries a description of the opportunity: the site or app, the slot, the device, and depending on platform and privacy controls, identifiers and coarse location. Every party that receives such a request can in principle evaluate whether a particular device is present, not just whether an audience segment is. Controlium, in Citizen Lab’s account, is what that capability looks like when it is industrialized: targeting by mobile advertising identifier, browser identifier and IP address, wrapped in a campaign-management interface for customers whose business is intrusion.

That produces two harms that coverage tends to conflate. The first is profiling and deanonymization at population scale. A pseudonymous advertising identifier stops being pseudonymous the moment it can be correlated with IP addresses, location patterns, carrier data or an external identity database. The second is conditional code delivery. Once a server can recognize one device inside an advertising request, it can also decide what that device executes, which turns the ad network into a targeting-aware distribution system. AdFection is what happens when a single operation runs both harms in sequence, using the first to feed the second.

The response so far, and its limits

The ecosystem reacted before publication. Google and IAB Europe removed Discover-Tech from their ad vendor registries in early October 2026. Google, which collaborated in the investigation, terminated the company’s access to its ad exchange platforms. Beeswax removed it from its ad-buying platform, Vungle (operated by Liftoff) paused its access while conducting a review, and Eskimi blocked its accounts and domains. Discover-Tech, Candiru, Bindecy and Intelos did not respond to the researchers’ letters seeking comment. These actions closed doors that mattered, but they also expose the weakness of a trust model in which vendor approval is granted at onboarding and revisited only when someone publishes a report.

Creative review and vendor paperwork cannot see this class of abuse. A submitted creative that merely contains a script tag pointing at a getAd server looks unremarkable, because the dangerous behavior lives in what the server returns later, to selected devices, after rendering. Monitoring that stops at the auction, or at the submitted artifact, misses the entire second half of the attack. Platforms that want to detect the next AdFection need post-render behavioral analysis, infrastructure reputation tracking across a vendor’s estate, and workable channels for cross-company abuse investigation. No single party in the chain observed both the exposed bidding records and the validator fingerprints that together made this case.

What defenders can do with the published material

For organizations with journalists, executives, litigators or researchers in scope, start with exposure reduction: reputable content-blocking controls on managed devices, privacy-preserving browser configurations, restrictions on third-party tracking and advertising identifiers where platforms allow them, and network-level egress filtering for high-risk populations. None of this is absolute protection. New delivery domains appear faster than blocklists, and an implant that already exists does not care about tomorrow’s filter list. Patching discipline still matters even though the report names no single CVE as a universal key, because keeping browsers, webviews and operating systems current shrinks the surface on which any delivered exploit lands.

The sequence is the most reusable part of the report, because it turns isolated indicators into a detectable pattern. The published infrastructure clusters by stage:

• Delivery: cloud-images.s3.eu-west-1.amazonaws[.]com and noas.mtrtb[.]com, with impression analytics and fingerprint exfiltration at dtech.adtimizer[.]co
• Validation: keyadapter[.]com and sharethere[.]net
• Exploitation: brainsolitary[.]com
• Command and control: fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com, rebookings[.]net, freshmeditate[.]com and dustclimate[.]com

Confiant’s broader indicator set adds the mtrtb[.]com and adtimizer[.]co namespaces and hosts such as myipinfo[.]io and volasim[.]com.

A lone request to a cloud bucket proves nothing. The same device touching a delivery domain, then a validator, then a suspected C2 host within minutes deserves correlation across DNS logs, proxy telemetry and endpoint records, with timestamps preserved. Where that sequence appears, escalate, but don’t treat it as a verdict on its own. Hold forensic evidence instead of reimaging reflexively. And remember that a missing sequence clears nothing, since operators rotate infrastructure.

Individuals whose work makes them plausible targets can read the same material as a layering checklist: a separate, well-maintained device for sensitive work, a minimal installed application set, reduced advertising exposure, and identifier hygiene that limits correlation even where it cannot promise anonymity. The Al Jazeera evidence shows what sits on those devices: unpublished reporting, source identities and private correspondence. A spyware infection can also endanger people who never touched the compromised phone.

Open questions

AdFection lands in a longer argument over whether programmatic advertising, as currently built, can be made safe for the people it watches. The identifiers that make real-time bidding efficient also make deanonymization cheap, and the code-execution permissions that make rich creatives possible also make conditional exploitation possible. Regulators and industry bodies now have a documented case in which both properties were weaponized by a vendor that sat inside approved vendor registries while operating, in the researchers’ assessment, no legitimate advertising business at all.

Still unknown are which government customers sat behind each campaign, how many infections occurred beyond the 45 targeted Al Jazeera devices, and which exact exploit chains completed the final hop. What the report does establish is that an ordinary ad impression, served through ordinary exchanges, can be the first step of a zero-click spyware operation, and the systems meant to police that path did not notice until researchers published what they had found.