Citizen Lab Links Israeli Ad Firm to Candiru Zero-Click Spyware Attacks
Summary
Citizen Lab says Discover-Tech ads were used in AdFection attacks that targeted at least 45 Al Jazeera devices with Candiru spyware between 2024 and 2025. Google and other ad platforms removed or blocked the firm.
Key points
- Citizen Lab reports that Discover-Tech’s Controlium platform enabled user de-anonymization, device fingerprinting, and zero-click spyware delivery through targeted ads.
- At least 45 devices within Al Jazeera were targeted between 2024 and 2025, leading to Candiru spyware infections, according to Citizen Lab.
- Discover-Tech ads reportedly appeared across nearly 200,000 websites and Android and iOS apps worldwide.
- A Discover-Tech server exposed four billion ad-bid records, Citizen Lab says.
- Citizen Lab also links Discover-Tech’s activity to other surveillance actors, including Dark Cartographer, which it says links mobile advertising IDs to phone numbers.
- In early October, Google and IAB Europe removed Discover-Tech from their ad vendor registries; Google blocked its access to ad exchanges, and Beeswax and Eskimi took similar measures.
- Citizen Lab recommends that defenders block targeted ads at the gateway until the industry can reliably block AdFection-style vectors.
Article Details
- Event Type
- AdFection targeted-ad campaign used for zero-click spyware delivery
- Impact
- At least 45 devices within Al Jazeera were targeted between 2024 and 2025, leading to Candiru spyware infections, according to Citizen Lab. Discover-Tech ads were also used to profile and track users; a server exposed four billion ad-bid records. Google and IAB Europe removed Discover-Tech from their ad vendor registries, and Google, Beeswax, and Eskimi restricted its access to advertising platforms.
Threat Actors
CandiruSpyware vendor whose spyware was delivered in AdFection attacks using Discover-Tech ads, according to Citizen Lab.DARK CARTOGRAPHERSurveillance threat actor reported by Citizen Lab to build databases linking mobile advertising identifiers to phone numbers by exploiting mobile-carrier vulnerabilities.
Vendors
CandiruCandiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports.Discover-TechAs part of the operation, dubbed AdFection, ads purchased by Israeli company Discover-Tech were used to de-anonymize, fingerprint, and infect users, and also allow threat actors to track millions of devices.