Abstract:
Citizen Lab, a cybersecurity research institute affiliated with the University of Toronto in Canada, recently disclosed the results of a survey that has attracted widespread attention. Researchers have discovered that a new attack method based on the online advertising delivery system has been actually used for espionage activities. Attackers can identify targets through online advertisements and deploy spyware on devices without even requiring victims to click on any links.
The research team named this technology "AdFection" and stated that this is the first time that technical evidence has been publicly obtained to prove that "zero-click" commercial spyware attacks can be implemented with the help of online advertising systems. The investigation revealed that the technology was used in an online penetration operation targeting Al Jazeera in Qatar.
According to the report, an Israeli company called Discover-Tech played a key role in this operation. The company claims to be a digital advertising company, but researchers believe it operates a platform that actually helps partners identify, track and target specific target devices.
The investigation pointed out that Discover-Tech operates a platform called Controlium. The platform is able to utilize an online advertising real-time bidding system to collect device information, including advertising identifiers and IP addresses. After the system identifies the intended target, it can send malicious code to the corresponding device, while ordinary users will only see ordinary advertising content. This means that the victim does not need to click on the ad or download any files, and the attack process can unfold automatically.
Researchers said that this platform can not only identify the target, but also become an entry point for malware to spread. In the case of Al Jazeera, attackers allegedly used this mechanism to deploy the Candiru commercial spyware to targeted devices. Candiru is a well-known spyware-for-hire tool that can remotely control devices, steal data, and access the device's camera and microphone.
Citizen Lab stated that they found that at least 45 devices on Al Jazeera's network were subject to related attacks, ranging from 2024 to 2025. Researchers believe this is the first publicly disclosed example of a complete technical zero-click spyware infection via targeted advertising.
The scope of this operation also goes well beyond individual targets. The research team analyzed approximately 4 billion ad bidding records and found that between March and June 2026, ads placed by Discover-Tech appeared on approximately 120,000 websites and more than 70,000 mobile applications around the world, involving multiple countries and regions.
The researchers further pointed out that these advertisements not only serve as commercial propaganda, but are also used for large-scale reconnaissance and target screening. Millions of devices were quietly directed to connect to Candiru-related servers, helping attackers gather information, identify targets, and prepare for subsequent attacks.
The investigation also found that Discover-Tech has long appeared on the certified supplier lists of many large advertising ecosystems, including the Google advertising system and the European advertising industry organization IAB Europe. This means its ads can reach a large number of websites and apps around the world.
In addition to Candiru, Citizen Lab also discovered that another threat group called "Dark Cartographer" is connected to the advertising platform. Researchers said that the organization mainly exploits mobile operator-related vulnerabilities to associate device advertising identifiers with real phone numbers, thereby achieving large-scale user deanonymization.
In an independent investigation, advertising security company Confiant also found that relevant advertisements had appeared in government departments, defense agencies, and NATO network environments. However, there is currently no evidence that these institutional devices were successfully infected.
After the incident was exposed, many advertising platforms have taken measures to cut off their cooperative relationships with Discover-Tech. At the same time, researchers are calling on regulators and the advertising industry to re-examine the security risks of the existing digital advertising ecosystem. They believe that advertising infrastructure originally used for commercial marketing has proven to be a tool for mass surveillance, target tracking and even cyber attacks, and this phenomenon poses new challenges to Internet privacy and network security.
Comments