Spyware vendors found a way to make targeted ads even worse

1. Executive summary

Citizen Lab has published what it describes as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted online advertising, a technique it calls "AdFection." The researchers attribute the delivery infrastructure to Israeli adtech firm Discover-Tech and its Controlium platform, which they say abused real-time bidding data to identify and target specific devices, and they link at least 45 infected devices at Al Jazeera in 2024 and 2025 to Candiru (now Integrity Labs) spyware served through Discover-Tech ads. Discover-Tech held approved-vendor status with Google and IAB Europe since 2020, and Citizen Lab found its ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026, including networks belonging to government agencies, defense organizations and NATO. No CVE, CVSS score or CISA KEV entry is associated with this item; the risk is supply-chain and third-party, not a patchable software defect. For EMEA financial services the exposure is indirect but real: any employee device that loads advertising inventory through an affected ad exchange or SDK is a potential profiling or delivery target, and the vendor-vetting failure Citizen Lab describes is the same control gap that DORA Art. 28 and NIS2 Art. 21(2)(d) place on regulated firms.

2. Regulatory framing

No specific DORA or NIS2 article is engaged by the reported infections themselves; the item contains no confirmed compromise of an EMEA financial services firm.

3. Technical analysis & attack chain

This is a threat-campaign item. There is no CVE, no CVSS score and no CISA KEV entry in the verified reference data. The attack does not exploit a software vulnerability in the traditional sense; it abuses the advertising delivery pipeline.

Confirmed steps, as reported by Citizen Lab via The Register:

1. A user opens a website or app that carries advertising inventory. No link click and no download is required.
2. The ad slot is filled through real-time bidding, the auction process that decides which ad appears. Bidders receive information about the user's device and location as part of the auction.
3. Discover-Tech's Controlium platform is alleged to have used that bidding data to identify specific targets and serve them malicious ads rather than ordinary creative.
4. The malicious ad delivers spyware. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered this way.
5. Separately, the operation covertly directed millions of devices toward servers associated with Candiru. Citizen Lab states these connections do not necessarily indicate spyware infection.

Scale and reach, from the same reporting: Citizen Lab reviewed nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026. Some of that inventory reached networks belonging to government agencies, defense organizations and NATO. Citizen Lab found no evidence those organizations were infected, but states the ads could have been used to profile devices on those networks.

Access was not obtained by intrusion. Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020. Google has since terminated Discover-Tech's access to its advertising exchanges and removed it from its approved vendor lists. IAB Europe followed, and Beeswax, Vungle and Eskimi also took action.

Confidence caveats. The attribution to Discover-Tech as a front for spyware delivery, the "AdFection" technique name, the 45-device Al Jazeera figure, the four-billion-record review and the 70,000-app / 120,000-site counts all rest on a single source: Citizen Lab's report as summarised by The Register. The Register states Discover-Tech and Candiru did not respond to requests for comment from Citizen Lab or from The Register. The verified reference data contains no MITRE ATT&CK profile for Candiru, Integrity Labs or Discover-Tech, so the Candiru-to-Integrity-Labs identity and the vendor attributions are unconfirmed and should be treated as allegations, not established fact. No technical artefacts (hashes, domains, IPs, SDK package names, bundle identifiers) are present in the source material, so no atomic indicators can be published here.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every advertising SDK and ad-exchange integration in your mobile apps, customer-facing web properties and employee device fleet. You cannot scope exposure without this list.
• Check whether Discover-Tech, Controlium, Beeswax, Vungle or Eskimi appear anywhere in your advertising supply chain, including as sub-processors or resellers. If they do, remove or disable the integration pending review.
• Confirm that Google and IAB Europe have in fact removed Discover-Tech from the approved-vendor lists your ad ops or procurement team relies on. Do not assume the removal propagated to your own allowlists.

P2 (within 72 hours)

• For employee devices, restrict or disable ad personalisation and third-party ad tracking at the MDM or browser policy level where operationally feasible. This reduces the bidding-data surface the technique depends on.
• Review network egress logs for device connections to Candiru-associated infrastructure. The source does not name specific domains or IPs, so this requires threat-intel enrichment from your feed provider; treat any resulting matches as leads, not proof of infection.
• Ask your adtech and SDK vendors in writing what controls they apply to detect malicious creative and to vet downstream bidders. Record the answers for your DORA Art. 28 third-party file.

P3 (within 7 days)

• Add advertising and SDK intermediaries to your ICT third-party register if they are not already there, with the same scrutiny applied to core IT vendors.
• Where contracts allow, exercise audit or information rights over adtech providers, or add them at renewal. DORA Art. 30 is the reference point for what those clauses should cover.
• Brief mobile threat defence and EDR owners on the zero-click ad-delivery pattern so that anomalous process or network activity originating from an ad SDK is investigated rather than dismissed as ad traffic.

There is no vendor patch for this item. The remediation is removal of the delivery path and tightening of vendor vetting.

5. Indicators of compromise

No indicators of compromise available in the source material. The reporting names no hashes, domains, IP addresses, file paths, package names or bundle identifiers.

The source does describe observable behaviours. These are not atomic indicators and cannot be used for machine pivoting, but they are worth hunting for.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named entities are company names and a platform name, which are not artefacts of the threat and would produce rules that match reporting about the campaign rather than the campaign itself.

7. Sources

• The Register, "Spyware vendors found a way to make targeted ads even worse," https://www.theregister.com/security/2026/10/15/spyware-vendors-found-a-way-to-make-targeted-ads-even-worse/5303334, 2026-10-15. (Single source; summarises a Citizen Lab report. The underlying Citizen Lab report URL is not provided in the source material.)

8. Adverse Trace position

Adverse Trace assesses this as a supply-chain and third-party risk item rather than a vulnerability with a patch path. There is no CVE, no CVSS score and no CISA KEV entry, so we do not assign a vulnerability severity; the relevant exposure for EMEA financial services is the advertising and SDK supply chain that most firms have never brought under ICT third-party governance. The attribution to Discover-Tech, Controlium and Candiru rests on a single source, Citizen Lab via The Register, and the verified reference data holds no MITRE ATT&CK profile for any of the three named actors, so we treat the attribution as unconfirmed and will not repeat it as fact in client briefings. We will monitor for the underlying Citizen Lab report and for any technical artefacts it publishes, and we will issue a follow-up if atomic indicators or SDK identifiers become available. Clients who embed third-party advertising in customer or employee apps should treat the P1 inventory step in section 4 as the immediate action.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.