Major Ad Networks Cut Off Discover-Tech After 200,000-Site AdFection Spyware Campaign
Updated
Updated · Computerworld · Oct 16
Major Ad Networks Cut Off Discover-Tech After 200,000-Site AdFection Spyware Campaign
3 articles · Updated · Computerworld · Oct 16
Summary
Citizen Lab said Google, IAB Europe, Beeswax, Liftoff and Eskimi disconnected Discover-Tech after finding its “AdFection” operation used online ads to profile users and selectively deliver zero-click spyware.
Over four months, Discover-Tech ads appeared on 120,768 websites and 75,373 apps in dozens of countries, with nearly 200,000 sites reached through major ad pipes including Google, Yandex and Beeswax.
The ads often looked harmless because most only sent back a device’s advertising ID and IP address; malicious code was returned only for chosen targets, helping the campaign evade third-party verification.
Citizen Lab linked Discover-Tech to spyware vendor Candiru and said ad impressions hit networks tied to NATO, critical infrastructure, media groups, Intel, Microsoft and Apple; Candiru previously infected Al Jazeera devices using the method.
Researchers said the case exposes a systemic weakness in real-time bidding, which runs hundreds of billions of auctions daily and can share precise identifiers and location data with little meaningful vetting.
How did a certified ad vendor weaponize GDPR privacy frameworks to silently deliver mercenary spyware to targeted devices without a single click?
If billions of ad bids happen in milliseconds, what stops the next legitimate marketing campaign from secretly profiling and infecting your phone?
Exposing "AdFection": How Discover-Tech Hijacked 4 Billion Ad Impressions for Zero-Click Spyware Attacks on Governments, Journalists, and Civil Society
Overview
The AdFection campaign exposed how Discover-Tech’s Controlium platform secretly connected global ad networks with mercenary spyware operators like Candiru, using advanced modules to inject malicious code into online ads. These ads, appearing on nearly 200,000 apps and websites, enabled zero-click spyware infections on target devices—including those of Al Jazeera journalists and sensitive government networks—without any user action. Controlium’s encrypted telemetry and IP validation blocked security researchers from detecting attacks. After Citizen Lab and Confiant revealed the operation in October 2026, major ad-tech platforms and industry bodies rapidly cut off Discover-Tech, sparking urgent calls for regulatory reform and stricter ad-tech security audits.