Researchers at The Citizen Lab and Confiant have identified a method they call 'AdFection,' where targeted online advertisements are used as a delivery mechanism for mercenary spyware. The investigation centers on Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm but is alleged to operate as a facilitator for spyware partners like Candiru (rebranded as Integrity Labs) and Bindecy. By leveraging the standard infrastructure of the online advertising ecosystem, these actors can deliver infections to devices the moment an advertisement is rendered, requiring no interaction from the user.
This figure illustrates the technical flow of the AdFection mechanism described in the first paragraph.
The mechanism relies on the standard architecture of Real-Time Bidding (RTB), where advertisers bid on the chance to show ads to specific users based on granular data like device identifiers and IP addresses. Discover-Tech reportedly utilizes a platform called Controlium to allow spyware customers to profile and de-anonymize individuals. The company also employs a 'NOAS server' (or 'getAd server') that receives advertising identifiers from a user's device. Based on the source IP and identifiers, the server decides whether to return JavaScript code. If the target is eligible, the server delivers code that can execute browser exploits to install spyware. This setup allows the company to avoid sharing malicious code directly with the major ad networks that serve the ads.
This figure explains the specific server-side logic and identifier processing mentioned in the second paragraph.
The scale of this operation is significant; analysis of four billion bidding records showed Discover-Tech's ads appearing on nearly 200,000 unique websites and apps across dozens of countries. Furthermore, the investigation found that a threat actor dubbed 'DARK CARTOGRAPHER' used Discover-Tech's infrastructure to link mobile advertising IDs with phone numbers, facilitating mass-deanonymization. While major platforms like Google and IAB Europe have since removed Discover-Tech from their 'certified' vendor lists, the report highlights a structural vulnerability in the advertising industry: the same systems designed to target consumers for products can be repurposed to target individuals for surveillance. The specific browser vulnerabilities exploited in these 'zero-click' attacks remain a point of technical scrutiny, as the primary report focuses on the delivery pipeline rather than the specific exploit code used to achieve persistence on the host device.
This figure supports the description of the 'DARK CARTOGRAPHER' actor's activities in the third paragraph.
Evidence: - The Citizen Lab report provides the primary technical confirmation of the AdFection pipeline and the specific role of Discover-Tech's Controlium and NOAS server platforms (primary). - Confiant's investigation corroborates the connection between Discover-Tech and the mercenary spyware firm Candiru, detailing the use of obfuscated JavaScript and C2 handshakes (support-2).