> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Candiru uses Discover-Tech ad platform for zero-click spyware delivery - URL: https://f4n6.co.uk/security-feed/candiru-uses-discover-tech-ad-platform-for-zero-click-spyware-delivery/ - Published: 2026-10-17T12:04:53.000Z - Updated: 2026-10-17T12:04:53.000Z - Author: Jeff Davies - Tags: #security-feed, Candiru, Discover-Tech, Dark Cartographer ## 1\. Executive summary Citizen Lab has documented a campaign, AdFection, in which ads brokered by Israeli adtech firm Discover-Tech were used to fingerprint devices and deliver Candiru spyware in zero-click attacks, with at least 45 devices at Al Jazeera targeted between 2024 and 2025\. Discover-Tech's Controlium platform sits inside the real-time bidding (RTB) ecosystem and, per Citizen Lab, served as a bridge between legitimate ad exchanges and multiple mercenary spyware vendors. Discover-Tech ads appeared across roughly 200,000 unique websites and mobile applications worldwide, and Citizen Lab found ads reaching networks belonging to government agencies, defence organisations and NATO, though it found no evidence those networks were infected. No CVE is associated with this item, so there is no CVSS score, no EPSS estimate and no CISA KEV entry to prioritise against. The exposure for EMEA financial services is not a patchable flaw: it is that staff mobile devices and browsers load ad content from an ecosystem that can fingerprint and, in the confirmed case, infect a device with no user interaction. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | Discover-Tech was an approved ad vendor in Google and IAB Europe registries since 2020, and its ads reached client-facing websites and apps through the RTB supply chain | Firms must be able to identify which adtech and RTB intermediaries sit in their own digital channels and apply third-party risk controls to them, not only to contracted core providers | | DORA Art. 29: preliminary assessment of ICT concentration risk | Ad delivery for a firm's own web and mobile properties concentrates through a small number of ad exchanges and vendor registries | Firms should assess whether blocking or losing a single ad exchange or vendor registry materially affects their own channels | | NIS2 Art. 21(2)(d): supply chain security measures | The delivery path runs through third-party ad vendors and exchanges the firm does not contract directly | Supply chain security measures must extend to the adtech intermediaries in the delivery path, including vendor registry status | ## 3\. Technical analysis & attack chain The attack does not require a user to click anything. The chain Citizen Lab describes runs through the normal operation of online advertising. 1. A user opens a website or mobile application that carries ad space. 2. The ad exchange runs a real-time bidding auction. Advertisers bid for the impression and, in the process, receive device and location data about the user. 3. Discover-Tech wins impressions through this auction process. Its ads contain a script that automatically connects to Discover-Tech infrastructure, submits the user's advertising ID, and executes JavaScript served back based on a combination of the user's IP address and identifiers. 4. That server-side logic performs de-anonymisation and device fingerprinting, and selects targets. 5. For selected targets, the ad response delivers an exploit that installs Candiru spyware with no user interaction (zero-click). 6. The infected device is then under Candiru control. The Controlium platform is the component Citizen Lab names as performing de-anonymisation of users, device fingerprinting, and the zero-click hacking step when an ad is displayed. Discover-Tech is described as working with multiple mercenary partners; Citizen Lab states it confirmed the use of Controlium to profile and infect users on behalf of Candiru. Scale, from Citizen Lab's review of a Discover-Tech server that exposed four billion ad bid records: Discover-Tech ads appeared across nearly 200,000 unique websites and Android and iOS applications worldwide. A separate count covering March to June 2026 places Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites. Ads reached networks belonging to government agencies, defence organisations and NATO; Citizen Lab found no evidence of infection on those networks but states the ads could have been used to profile devices there. The operation also directed millions of devices toward servers associated with Candiru, though Citizen Lab notes those connections do not by themselves indicate spyware infection. Confirmed targeting: at least 45 devices within Al Jazeera, across 2024 and 2025, in AdFection attacks leading to Candiru spyware. Attribution caveats. Candiru, Discover-Tech and Dark Cartographer have no MITRE ATT&CK profile, so the attribution of the AdFection operation to Candiru and of the Controlium platform to Discover-Tech rests on Citizen Lab's reporting and is unconfirmed by independent sources in this advisory. The Dark Cartographer activity, described as building databases linking users' mobile advertising identifiers to their phone numbers by exploiting vulnerabilities across various mobile carriers, is reported by Citizen Lab and is not corroborated elsewhere here. The specific exploit used in the zero-click step, the spyware's post-infection capabilities, any command-and-control infrastructure, and any persistence mechanism are not described in the source material and are not stated here. Vendor response, early October 2026: Google and IAB Europe removed Discover-Tech from their ad vendor registries; Google blocked Discover-Tech's access to its ad exchange platforms; Beeswax and Eskimi took similar measures. The Register additionally reports Vungle took action. Discover-Tech and Candiru did not respond to Citizen Lab's requests for comment. ## 4\. Mitigation & containment P1 within 24h - Block targeted ads at the network gateway for staff devices and for any corporate-managed browser or app environment. Citizen Lab's own recommendation is explicit: given the AdFection vectors and the evidence of wide-scale targeting, the most feasible protection is to block targeted ads at the gateway, and that recommendation holds until the industry can reliably block all AdFection-style vectors. This is the single highest-value control in this advisory. - Confirm Discover-Tech is not present in any ad vendor registry, allowlist or supply path used by the firm's own web and mobile properties. Google, IAB Europe, Beeswax and Eskimi have removed or blocked the company; any internal allowlist still carrying it is stale. - If the firm operates its own ad-funded web or mobile properties, audit the RTB supply chain for Discover-Tech and for any intermediary that resold its inventory. P2 within 72h - Treat staff mobile devices as the primary exposure surface. The confirmed infections were on mobile devices reached through apps and browsers. Enforce ad and tracker blocking on managed mobile devices, and review whether unmanaged personal devices used for corporate email or messaging can be brought under the same gateway control. - For high-risk staff (journalists, executives, anyone whose advertising ID could be linked to their identity), consider a stronger posture than ad blocking: the Dark Cartographer activity described by Citizen Lab links mobile advertising identifiers to phone numbers, which turns an ad ID into a targeting key. P3 within 7 days - Review third-party risk records for adtech and RTB intermediaries that touch the firm's digital channels, and record their vendor registry status as a monitored field. Discover-Tech sat in Google and IAB Europe registries from 2020, so registry approval is not by itself evidence of safety. - Where the firm's own properties serve ads, add a control that detects ad scripts making automatic outbound connections to non-approved infrastructure on page load. There is no vendor patch for this item. No CVE is associated with it, and no fixed version exists to pin to. The controls above are the available mitigation. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe the mechanism (ad script connects to Discover-Tech infrastructure, submits an advertising ID, executes server-returned JavaScript) but publish no domains, IP addresses, hashes, file paths or registry keys. The behavioural indicators below are the observable patterns Citizen Lab describes; they are single-sourced to Citizen Lab and should be verified before enforcement. ### Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | Ad script automatically connects to external infrastructure on ad render, without user interaction | Browser or app network telemetry, proxy logs, mobile device management network capture | Single-sourced (Citizen Lab); verify before enforcement | | Advertising ID submitted to an ad server alongside IP address and device identifiers | Ad request telemetry, proxy logs where ad traffic is visible | Single-sourced (Citizen Lab); verify before enforcement | | Server-returned JavaScript executed in the ad context, with content varying by IP and identifier | Browser or app runtime telemetry, content security policy violation reports | Single-sourced (Citizen Lab); verify before enforcement | | Device directed to infrastructure associated with Candiru | Network egress logs, DNS logs | Single-sourced (Citizen Lab); connection alone does not indicate infection | ## 6\. Detection The sources give no file hashes, command-line flags, mutex names, file paths, registry keys or hard-coded strings from the malware or the ad script. There are no threat artefacts to build a YARA rule from, and a rule keyed on "Discover-Tech", "Candiru" or "AdFection" would detect reporting about the threat rather than the threat. No YARA rule is emitted. The behavioural pattern is detectable at the network and browser layer. The Sigma rule below targets the observable behaviour Citizen Lab describes: an ad-context process making an automatic outbound connection on page or ad render to infrastructure outside the approved ad vendor set. The approved-vendor list is environment-specific and must be populated locally; the rule as written flags the pattern, not a named domain. ```yaml title: Ad Render Triggers Automatic Outbound Connection to Non-Approved Ad Infrastructure id: 8f2c1a44-7b6e-4d19-9c3a-2e5f0b7a1d90 status: experimental description: > Detects browser or in-app ad rendering that immediately triggers an outbound network connection to infrastructure outside the organisation's approved ad vendor set. Pattern matches the AdFection delivery behaviour described by Citizen Lab, where an ad script automatically connects to ad-serving infrastructure, submits an advertising ID, and executes server-returned JavaScript without user interaction. author: Adverse Trace date: 2026-10-17 references: - https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/ - https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334 logsource: category: network_connection product: windows detection: selection_process: Image|endswith: - '\chrome.exe' - '\msedge.exe' - '\firefox.exe' - '\brave.exe' selection_destination: DestinationHostname|endswith: - '.example-ad-exchange.invalid' filter_approved: DestinationHostname|endswith: - '.approved-vendor-1.invalid' - '.approved-vendor-2.invalid' condition: selection_process and selection_destination and not filter_approved falsepositives: - Legitimate ad vendors not yet added to the approved list - Browser extensions making their own network connections level: medium ``` The destination and approved-vendor values above are placeholders and must be replaced with the firm's actual ad vendor inventory before deployment. No real domain from this campaign is published in the sources, so none is used. ## 7\. Sources - Citizen Lab, via SecurityWeek, "Israeli Ad Firm Doubled as Candiru's Zero-Click Spyware Delivery Channel", https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/, 2026-10-17 - The Register, "Spyware vendors found a way to make targeted ads even worse", https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334, 2026-10-15 Both sources report the same Citizen Lab research. The technical detail in §3 is single-sourced to Citizen Lab as relayed by these two outlets; no independent corroboration of the AdFection mechanism or the Candiru attribution is present in the material reviewed. ## 8\. Adverse Trace position Adverse Trace assesses this as a targeted espionage delivery technique rather than a broad opportunistic malware campaign, and the risk to EMEA financial services is concentrated in staff mobile devices and in any client-facing web or mobile property that serves third-party ads. There is no CVE, no CVSS score, no EPSS estimate and no CISA KEV entry for this item, so it cannot be prioritised through the usual vulnerability workflow; the control that matters is blocking targeted ads at the gateway, which Citizen Lab recommends directly. The Candiru, Discover-Tech and Dark Cartographer attributions are unconfirmed: none has a MITRE ATT&CK profile, and the technical detail rests on a single research effort. We will monitor for publication of the underlying Citizen Lab report and for any atomic indicators (domains, ad script hashes, infrastructure) that would let us move from behavioural detection to enforcement-grade blocking, and we will update this advisory if independent corroboration of the delivery mechanism or the attribution appears. Clients who serve third-party ads on their own properties should treat the adtech supply chain as an in-scope third party under their DORA Art. 28 programme now, not at the next review cycle. --- [Read the original source →](https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*