Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

How Discover-Tech turned targeted ads into a pipeline for zero-click spywares

2 sources · 2 articlesFirst reported Updated ()
Merged summary · from the lead articleSummaries by Vani AI

Citizen Lab says Discover-Tech delivered Candiru zero-click spyware to Al Jazeera through targeted ads.

Citizen Lab reports that devices at Al Jazeera were infected with mercenary spyware from Candiru, rebranded as Integrity Labs, through targeted online ads. An Israeli firm, Discover-Tech, bought the ads and ran a platform called Controlium that de-anonymized, fingerprinted, and automatically infected devices when an advertisement rendered—a zero-click method the researchers name AdFection. Analysis of four billion bidding records found Discover-Tech ads on almost 200,000 websites and Android and iOS apps, while millions of devices were covertly directed to Candiru servers. The firm is also linked to Intelos, Bindecy, and a separate actor, DARK CARTOGRAPHER, which allegedly exploited mobile-carrier flaws to tie advertising IDs to phone numbers. Google, IAB Europe, Beeswax, Vungle, and Eskimi later disconnected Discover-Tech.

Key facts
  • Al Jazeera devices were infected with Candiru spyware through targeted ads.
  • Citizen Lab calls the zero-click ad delivery method AdFection, the first public confirmation of this vector.
  • Discover-Tech’s Controlium platform fingerprinted devices and infected them when ads rendered.
  • Ads on nearly 200,000 sites and apps also sent millions of devices to Candiru servers.
  • Google, IAB Europe, Beeswax, Vungle, and Eskimi cut off Discover-Tech after disclosure.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
GoogleYandexBeeswaxVungleCandiruEskimiDiscover-Tech
Products
ControliumMyDSPDevilsTongue
Threat actors
CandiruDiscover-TechDARK CARTOGRAPHERIntelosBindecyIntegrity LabsDark Cartographer
Malware
CandiruDevilsTonguePredatorAdFection
Victims
Al Jazeera
Organizations
Citizen LabGoogleIAB EuropeBeeswaxVungleEskimiYandexIntegrity LabsAl JazeeraDiscover-TechLiftoffNATO
Countries
IsraelQatarAustraliaNorwaySwedenUnited StatesEstonia

Coverage

oldest first · one row per article · UTC
  1. · 15d ago Cyber Security NewsFirst report

    Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal

    Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click code hidden in online advertisements.

  2. · 15d ago Security Affairs

    AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks

    Citizen Lab says Candiru used Discover-Tech ads for zero-click spyware, hitting at least 45 Al Jazeera devices.