Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Citizen Lab says Candiru infected at least 45 Al Jazeera devices through Discover-Tech zero-click ads.
Citizen Lab says Israeli ad firm Discover-Tech delivered Candiru mercenary spyware in an operation called AdFection. Between 2024 and 2025, at least 45 Al Jazeera devices were targeted with zero-click infections when malicious ads executed in browsers or apps. Controlium de-anonymized users, fingerprinted devices, and ran JavaScript selected by advertising IDs and IP addresses. A Discover-Tech server exposed about four billion bid records spanning nearly 200,000 websites and Android and iOS apps; Google, IAB Europe, Beeswax, and Eskimi later cut the company off.
- Candiru infected at least 45 Al Jazeera devices in 2024–2025.
- Discover-Tech's Controlium used ads to fingerprint users and deliver zero-click spyware.
- An exposed server held four billion bid records across nearly 200,000 sites and apps.
- Google and major ad exchanges later blocked or removed Discover-Tech.
- ATT&CK
- T1189 Drive-by CompromiseT1059.007 Command and Scripting Interpreter: JavaScriptT1082 System Information Discovery
- Vendors
- CandiruDiscover-TechGoogle
- Products
- Controlium
- Threat actors
- CandiruDark CartographerDiscover-Tech
- Malware
- Candiru
- Victims
- Al Jazeera
- Organizations
- Citizen LabIAB EuropeBeeswaxEskimi
- Countries
- Israel
From the original article
2 min read at securityweek.com
Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.