AdFection: How Targeted Ads Delivered Zero-Click Candiru Spyware

AdFection, exposed by Citizen Lab on 15 October 2026, is how Israeli firm Discover-Tech used ordinary targeted ads to fingerprint chosen people and hand their devices to Candiru spyware with no click. At least 45 Al Jazeera devices were targeted. Block ads and advertising IDs on managed devices and search DNS logs for the published domains.

The ad itself carried no exploit. That is the uncomfortable part. A Discover-Tech ad won an auction like any other, rendered in an app or a web page, and asked a Discover-Tech server whether this particular device was wanted. For almost everyone the answer was an empty reply. For the chosen few, the server sent JavaScript that pointed the device onward toward Candiru's servers. The exchanges that sold the ad space never saw the malicious code, because it was never in the ad they reviewed.

This post goes through what Citizen Lab's Report 195 found, the technical indicators it published, what a security vendor's parallel report added, where the two disagree, and what any security team can do this week. It also covers a less obvious point for software teams: if your own mobile app embeds an ad SDK, it renders creatives that a stranger chose, and that SDK belongs in your inventory like any other third party code.

What happened

Citizen Lab published "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware" on 15 October 2026 as Report 195. The authors are Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. Citizen Lab describes it as the first public technical demonstration of in-the-wild infection with zero-click mercenary spyware through targeted advertisements. A security vendor published a parallel investigation into the same operator on the same day.

Citizen Lab says Discover-Tech presented itself as an advertising company but found no evidence of legitimate advertising activity. Its platform, Controlium, let customers pick targets by mobile advertising ID, browser cookie ID or IP address, and push "controlled ads" to them. Customers and linked firms named in the report include Candiru, which Citizen Lab says rebranded as Integrity Labs in December 2024, plus Bindecy and Intelos. A separate actor the report calls DARK CARTOGRAPHER used the same infrastructure to tie advertising IDs to phone numbers.

The confirmed infection case is Al Jazeera. Citizen Lab links, with high confidence, a series of 2024 and 2025 zero-click attacks on at least 45 devices inside the network to Candiru spyware delivered through Discover-Tech ads. Al Jazeera's own reporting says its in-house technology team first noticed unusual patterns on some devices in 2024, and that network logs it provided in 2025 showed a clear timing pattern.

Timeline

Neither Citizen Lab nor the other sources publish minute-level times for this incident; the most precise published granularity is the day. Dates below are as stated by each source.

Who is affected

Citizen Lab is careful on one point, and so are we: an ad impression on a network does not prove that anyone on that network was targeted or infected. It proves that a Discover-Tech ad rendered there. In iTnews's report, Citizen Lab says that at minimum it assesses those impressions would have resulted in profiling by Discover-Tech. Infection is confirmed only where the report says so, which in this report means the Al Jazeera case.

The security vendor's report adds a narrower figure. It saw devices handed to Candiru's systems in nine countries during its window: Belgium, the UAE, Montenegro, Bahrain, Thailand, Saudi Arabia, Mexico, Spain and Malaysia, with Belgium the first and the largest share. iTnews notes that Australia was not among them. Daily volumes for that handoff were in the hundreds to low thousands of impressions.

How AdFection works

Programmatic advertising runs an auction every time an app or page has an ad slot. The publisher's side sends a bid request with whatever it knows about the device: an IP address, rough location, a user agent and often a mobile advertising ID or a cookie ID. Demand side platforms bid. The winner's creative is delivered and rendered. Creatives are allowed to contain HTML and JavaScript, so a rendered ad is code running on the device inside the app's or browser's ad container.

Discover-Tech ran its own demand side platform, MyDSP, and bought ad space through upstream exchanges. Citizen Lab describes the chain in four steps, which we summarise in plain language:

1. Discover-Tech wins a bid and its ad renders in a browser or app, sometimes in the background where the user never sees it.
2. A script tag inside the ad calls a Discover-Tech "NOAS" server at a /getAd path, passing the advertising identifiers and IP-derived data it has.
3. The NOAS server decides whether this device is an eligible target. If it is, the server returns JavaScript. If not, it returns a 0-byte response.
4. On an eligible device, traffic then goes to a Candiru "validator" server and on to a Candiru command and control server. The Al Jazeera network logs show this sequence.

Step 3 is the design choice that made the operation hard to see. Ad exchanges scan creatives. Discover-Tech's creatives only contained a pointer to its own server, and that server answered with nothing for almost everyone, including scanners. Citizen Lab says this let Discover-Tech avoid sharing malicious code, or even pointers to it, with the companies that served and displayed the ads. Eskimi told Citizen Lab the advertiser's tags evaded its scanning.

Rendering JavaScript in an ad container is not, on its own, full control of a device. Al Jazeera quotes outside experts making the same point: attackers generally need further vulnerabilities to get out of the browser or app sandbox. The reports do not publish the browser or operating system exploits used in the 2024 to 2026 attacks. What Citizen Lab does publish is the spyware that ended up on a Windows device, and its similarity to Candiru's 2021 chain, which did use browser and Windows zero-days.

What Controlium offered its customers

According to the report, Controlium offered target selection by mobile advertising ID (iOS or Android), browser cookie ID (MyDSP or Beeswax) and IP address; campaign types including "Script" and "De-anon"; admin controls such as IP allowlists, country block lists and campaign limits; an "Ad URL OpSec" feature that encrypted link parameters so the receiving server could check the intended target; and add-ons including "Infinite FIFO". Upstream routes in the interface were labelled "MyDSP WW", "MyDSP Yandex RU", "Beeswax (Palm 3)" and "MyDSP Google (Palm 3)".

Profiling at scale, infection by selection

Most of the traffic was profiling. Citizen Lab says Discover-Tech ads directed millions of devices to contact Candiru servers, likely for tracking and reconnaissance. The security vendor's report adds that a creative read the page's first-party cookies and high-entropy user agent data and sent them to Discover-Tech endpoints, which it says happened even without GDPR consent. Separately, Citizen Lab says an actor it calls DARK CARTOGRAPHER exploits flaws in mobile carriers' "zero-click login" and header enrichment features to expose phone numbers (MSISDNs) and links them to advertising IDs, in more than 30 countries since at least 2019. A separate report is promised.

Technical details

Everything in this section comes from the fetched primary sources, mainly Citizen Lab's Report 195 and its appendix, with the security vendor's report marked where used. Domains are defanged with [.] as in the sources. These are for blocking and log searching only.

The Candiru sample from the Al Jazeera case

For context, Citizen Lab's 2021 report says Candiru's earlier implant hijacked a WMI COM class registry value to load a malicious IMJPUEXP.DLL from the Japanese input method folder, which then loaded the real wmiutils.dll. The 2026 sample uses different DLLs, so do not hunt only for that file name.

Candiru server fingerprints

Citizen Lab built two HTTP banner fingerprints from internet scan data.

Fingerprint C1 (command and control). Four servers matched: fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com. The banner pattern is an nginx response with Connection: keep-alive and a text/html content type. As published:

HTTP/1\.1 [0-9]+ \r\nDate: [^\r\n]+\r?\nContent-Type: text/html[^\r\n]*\r\nContent-Length: [0-9]+\r\nConnection: keep-alive\r\nserver: nginx\r\n$

Fingerprint V1 (validator). Based on keyadapter[.]com and sharethere[.]net. Citizen Lab found 305 distinct domains on 319 IP addresses matching it between August 2022 and July 2026, with the behaviour being retired gradually in May and June 2026. As published:

HTTP/1\.1 [^\r\n]+\r\ndate: [^\r\n]+\r?\n(connection: [^\r\n]+\r\n)?content-type: [^\r\n]+\r\nserver: Apache[^\r\n]*\r\ncontent-length: [0-9]+\r\n.*

Citizen Lab's footnote says the optional \r after the date header accounts for a 2022 scan platform bug, not server behaviour, and that anyone writing signatures over 2022-era banner data should make a similar allowance.

Citizen Lab also notes two domains matching C1, registered within two hours of each other on 18 March 2025 with the same contact in their SOA record, which it describes as Candiru profiling servers: outdooutcome[.]com and suggestutterly[.]com.

How Citizen Lab tied the ads to Candiru

Candiru infection links seen in 2024 and 2025 pointed to at least six Fingerprint V1 domains and carried a ?q= parameter holding 16 bytes of Base64 data. In every case, Citizen Lab says, that value decrypted correctly with a "V1" AES-256 key that Discover-Tech had published on a page called "Ad URL OpSec Decoder" on myipinfo[.]io, a site the report links to Discover-Tech. In other words, the encrypted ad impression data that Controlium's OpSec feature produced was what arrived at Candiru's validators.

NOAS servers and the getAd endpoint

The NOAS servers listed in Citizen Lab's Appendix C as operated, or previously operated, by Discover-Tech:

Citizen Lab lists further NOAS domains that appear associated with Discover-Tech: noas.adtimizer[.]co, noas.impchkdsp[.]com and noas.trakking[.]co. Eskimi reported "getAd" loaders on dtech.adtimizer.co, the noas, infinoas and ppv2 subdomains of mtrtb.com, and events.myweb3id.io.

When researchers sent dummy ID values, a NOAS server returned JavaScript that loaded a hidden iframe. Citizen Lab did not obtain the follow-on code from the infection domains, which it attributes to the OpSec feature.

Infinite FIFO, ppv2 and V3 OpSec

• In 2025, a campaign under Infinite FIFO ID 778 sent users to sincereaccertain[.]com and d1fcoizt7mje85.cloudfront[.]net. Citizen Lab estimates hundreds of thousands to millions of users were directed to these domains. Deployment of the CloudFront URLs appeared to stop in December 2025.
• From January 2026, a new NOAS host, ppv2.mtrtb[.]com, ran an evolved Infinite FIFO. An unauthenticated statistics endpoint counted 3,637,213 "eligible users" between January and June 2026, when the endpoint was removed. Citizen Lab notes that customers other than Candiru may also have used the feature.
• Later in 2026, Citizen Lab saw a move to what it assesses is "V3 OpSec": a custom parameter name instead of qq (it saw impid) and a per-user key. Discover-Tech did not update its decoder page for V3, so Citizen Lab could not decrypt that data.

The security vendor's report lists the CloudFront hosts it saw carrying the ?impid= Candiru handoff: d23625plpxg1yn, d39619tdxn6mhj, d2f4zpg1mgzwov, d1fzw0miu1r9rc, d19oo8r6k9oumb, d147nolwbekx2b, dcv2rnj2ograe and d1x4e580sn23dn (each under .cloudfront[.]net), plus d2epnp0vokbtl7.cloudfront[.]net for a separate ?qq= iframe payload, d8lmy5wyiokrq.cloudfront[.]net for delivery and pagead.trustlayersdk[.]com as SDK command and control. It says the CloudFront hosts rotated out after a few days, so they are more useful for searching old logs than for blocking.

The SDK behaviour the security vendor describes

That report describes the code loaded by the /getAd chain as an obfuscated SDK of about 90 KB. It derives a key with its server using ECDH, fingerprints the device, watches input and visibility events, polls about once a second, returns AES-encrypted results with the key wrapped by RSA, and runs operator-supplied code through new Function(...). It also uses a DNS-over-HTTPS "pingback" and then connects to a raw IP, so a hunt that relies only on internal DNS logs will miss that lookup.

The exposed bidding database

Citizen Lab found two world-readable Apache Druid instances on mtrtb[.]com: druid.mtrtb[.]com with MyDSP bidding data and cn.druid.mtrtb[.]com with data for Discover-Tech's use of Sunteng. They held no cookie IDs, ad IDs or GPS coordinates, but did hold IP addresses or /24 prefixes and city-level geolocation. Discover-Tech shut both down in August 2026.

By raw bids, the top countries were Yemen (457,283,658), Pakistan (139,427,322) and Montenegro (97,595,716); per capita, Montenegro led at 156.68 bids per person. Citizen Lab calls the near zero revenue and conversion fields highly unusual for an advertiser, which fits its view that this was not real advertising. The data does not cover Discover-Tech's use of Beeswax or Eskimi, so it undercounts total activity.

The Controlium authentication flaw

Controlium's hosted identity provider returned a signed JWT that the backend should have validated. Citizen Lab says Controlium ignored it and accepted a separately encrypted user object instead, with the key shipped in the frontend, so a valid token could likely be spoofed. Citizen Lab did not try. Separately, an unauthenticated endpoint returned login logs to a plain GET request: 128 days covering 120 distinct usernames on controlium[.]net and powerium[.]net, with source IPs.

Other actors on the same infrastructure

Discover-Tech infrastructure (Citizen Lab Appendix C and report body)

Two companies whose domains appear in this list told Citizen Lab they had no involvement. Adtimizer said its subdomains were used only within Discover-Tech's infrastructure and denied knowledge of the activity. Volasim said Discover-Tech was an external advertising provider it engaged and denied involvement in spyware activity. Citizen Lab describes the Appendix C links as assessed, not confirmed.

Ad industry identifiers

PPC Land gives the listing identifiers: IAB Europe Global Vendor List vendor ID 778, Google Ad Manager Certified External Vendors ID 4824, and Google ads personalization provider ID 3036 covering mtrtb.com, mydsp.io and tracker.mtrtb.com. Consent management platforms that still reference vendor 778 should drop it.

Affected and fixed versions

AdFection is not a software vulnerability with a CVE and a fixed version. It is an abuse of how ad auctions and ad rendering work, carried out through a company that was, until early October 2026, an approved vendor. There is no patch to install for AdFection itself. The fixes are configuration, blocking and policy.

The exploits that followed the ad, in the 2024 to 2026 attacks, have not been published. The only CVEs tied to Candiru in the fetched sources are from the 2021 chain, listed here for context and because unpatched systems from that era should not exist anywhere in 2026:

What has "fixed" status for AdFection is the ad supply side: Google, IAB Europe, Vungle (Liftoff), Beeswax and Eskimi cut or paused Discover-Tech between early October and 14 October, as in the timeline above. Citizen Lab lists Xandr, Sunteng and Affle, as well as Discover-Tech, Candiru, Bindecy and Intelos, as not responding within its timeline. Yandex, the largest upstream exchange by share of bids, has no recorded response in the sources we fetched.

Detection and response, step by step

The goal is to answer three questions for your own estate. Did Discover-Tech ads render on our networks? Did any device go beyond profiling and reach Candiru infrastructure? Are we still exposed to the same delivery path? None of the steps below involve touching the attackers' systems.

1. Build the blocklist file

Put the published indicators in one file. Keep them defanged in the file you share, and refang only when loading into a resolver.

cat > adfection-iocs-defanged.txt <<'EOF'
controlium[.]net
powerium[.]net
mtrtb[.]com
mydsp[.]io
discover-tech[.]io
platc-tester[.]com
myweb3id[.]io
myipinfo[.]io
akedo[.]gg
volasim[.]com
adtimizer[.]co
impchkdsp[.]com
trakking[.]co
tracookiepixel[.]xyz
cookiesurfer[.]com
cookie-sync[.]xyz
ads-monitor[.]xyz
checkmyimp[.]com
ads-impressions[.]com
nutralove[.]co
relevantech[.]com
tekma-dmp[.]ai
tekma[.]io
sincereaccertain[.]com
fearevolve[.]com
jobmarcher[.]com
insightenterprisells[.]com
plasticbells[.]com
keyadapter[.]com
sharethere[.]net
outdooutcome[.]com
suggestutterly[.]com
pickarest[.]com
infoanalytics[.]live
beachvibesnow[.]com
enjoymultiplecats[.]com
icecreamtester[.]com
globaldatapoints[.]com
intelos[.]io
trustlayersdk[.]com
EOF

sed 's/\[\.\]/./g' adfection-iocs-defanged.txt | sort -u > adfection-iocs.txt
wc -l adfection-iocs.txt

Do not add cloudfront.net or amazonaws.com as whole domains; block the specific hostnames only. Citizen Lab lists 305 validator domains in total, of which only a few are public in the sources we fetched; treat this file as a start, not a complete list.

2. Search historical DNS and proxy logs

Search back to at least 2024, because the Al Jazeera attacks ran in 2024 and 2025 and the validator fingerprint dates to 2022. Examples for common log formats:

# Plain text resolver or proxy logs
grep -F -f adfection-iocs.txt /var/log/squid/access.log* | head

# Compressed archives
zgrep -F -f adfection-iocs.txt /var/log/dns/*.gz | cut -d' ' -f1-8 | sort | uniq -c | sort -rn | head

# Zeek dns.log (query field)
zcat /opt/zeek/logs/*/dns.*.log.gz | zeek-cut ts id.orig_h query | grep -F -f adfection-iocs.txt

# The specific CloudFront hosts from the security vendor's report
grep -E 'd23625plpxg1yn|d39619tdxn6mhj|d2f4zpg1mgzwov|d1fzw0miu1r9rc|d19oo8r6k9oumb|d147nolwbekx2b|dcv2rnj2ograe|d1x4e580sn23dn|d2epnp0vokbtl7|d8lmy5wyiokrq|d1fcoizt7mje85' /var/log/squid/access.log*

Read the results in two tiers. Hits on tracking and NOAS domains (mtrtb, tracookiepixel, cookie-sync, myweb3id) mean a Discover-Tech ad rendered and probably profiled the device. Hits on validator or C&C domains (keyadapter, sharethere, fearevolve, jobmarcher, insightenterprisells, plasticbells, the profiling pair, the CloudFront handoff hosts) are much more serious and justify incident response on that specific device.

3. Look for the DoH pingback pattern

Because the SDK described by the security vendor resolves names over DNS-over-HTTPS and then connects by IP, look for HTTPS connections to public DoH resolvers from endpoints that do not normally use them, followed within a minute by TLS connections with no server name to a bare IP. In Zeek, filter ssl.log on server_name matching common DoH hosts, then review the next connections from the same host. Treat it as a lead, not a verdict; plenty of software uses DoH legitimately.

4. Check Windows endpoints for the published sample

Search for the SHA-256 from Citizen Lab across managed Windows hosts. A local check in PowerShell:

$target = '255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8'
Get-ChildItem -Path C:\Windows, C:\ProgramData, $env:LOCALAPPDATA, $env:APPDATA -Recurse -Include *.dll -ErrorAction SilentlyContinue |
  ForEach-Object { $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower(); if ($h -eq $target) { $_.FullName } }

In practice you will run the hash search through your EDR's fleet query rather than a script per machine. The sample is the one Al Jazeera isolated; a different build would have a different hash, so a clean result does not clear a device that has network hits on C&C domains.

5. Review COM registrations for hijacks

Both the 2021 and 2026 Candiru samples persist through a COM hijack. Per-user COM registrations under HKCU override machine-wide ones, which is the usual way such hijacks work. List per-user InprocServer32 entries and look for DLLs in unusual folders:

Get-ChildItem 'HKCU:\Software\Classes\CLSID' -ErrorAction SilentlyContinue |
  ForEach-Object {
    $p = Join-Path $_.PSPath 'InprocServer32'
    if (Test-Path $p) { [pscustomobject]@{ CLSID = $_.PSChildName; Dll = (Get-ItemProperty $p).'(default)' } }
  } | Where-Object { $_.Dll } | Format-Table -AutoSize

For machine-wide entries, compare HKLM:\Software\Classes\CLSID\*\InprocServer32 values against a known good baseline from the same build. The 2021 sample loaded from the Japanese input method folder; anything loading from C:\Windows\IME that your image did not ship deserves a look.

6. Turn off advertising IDs on managed phones

Citizen Lab says blocking advertising identifiers would directly block Discover-Tech's current targeting methods, and recommends disabling them on government phones through MDM.

• iOS and iPadOS: use your MDM's restrictions payload to stop apps requesting to track. Without consent, apps get an all-zero advertising ID.
• Android 12 and later: Settings, Privacy (or Google), Ads, Delete advertising ID; apps then receive zeros. Check what your EMM can enforce on work profiles.
• High-risk staff: Al Jazeera's experts suggest Lockdown Mode on iPhone or Android's Advanced Protection, plus prompt updates.

Citizen Lab's targeting also worked on IP addresses alone, so this narrows exposure rather than closing it.

7. Block ads at the gateway and on the endpoint

Citizen Lab recommends blocking ads and tracking at the gateway and on work-issued devices, and points back to US agency guidance: CISA's capacity enhancement guide on malvertising recommends standardising browsers, deploying ad blocking, and using protective DNS to stop resolution of known malvertising domains. iTnews notes that Australia's Essential Eight already requires browsers not to process web advertisements, and that ASD's newer framework asks organisations to consider all applications, not just browsers.

That last point is the key gap. About 76.7% of Discover-Tech's bids were for in-app ads, per Citizen Lab, where a browser extension does nothing. Only DNS or network level blocking reaches ads inside apps. Example for Unbound:

# Generate local-zone entries from the refanged IOC list
awk '{print "local-zone: \""$1".\" always_nxdomain"}' adfection-iocs.txt > /etc/unbound/adfection.conf
echo 'include: "/etc/unbound/adfection.conf"' >> /etc/unbound/unbound.conf
unbound-checkconf && systemctl reload unbound

For dnsmasq:

awk '{print "address=/"$1"/"}' adfection-iocs.txt > /etc/dnsmasq.d/adfection.conf
systemctl restart dnsmasq

A broad, maintained ad and tracker blocklist on the same resolver gives far more coverage than this IOC list, because the next operator will use new domains. Make sure phones on VPN and on corporate Wi-Fi actually use that resolver, and that DoH in browsers is either pointed at it or disabled by policy, or the blocking can be bypassed.

8. If you find C&C contact

Isolate the device, preserve memory and disk images before rebooting, collect network logs around the first contact, and bring in your national CERT or incident response retainer. Rotate credentials and session cookies used on that device: Al Jazeera's reporting lists saved credentials and cookies among what the spyware collects.

If you ship an app with an ad SDK

Most security teams will read AdFection as a network and endpoint problem. Software teams should read it as a third party code problem too. Citizen Lab notes that the Vungle SDK alone, according to that company, is embedded in 150,000 mobile apps. Discover-Tech's ads showed in 75,373 apps. Every one of those apps rendered a creative chosen by an auction, containing JavaScript from a buyer the app's developer never met.

That does not make an ad SDK vulnerable in the CVE sense. It means the SDK is a pipe for attacker-controlled content into your app's process or web view, and its configuration decides how much that content can do. Practical steps:

1. Inventory every ad and attribution SDK, with versions, per app. On Android, from the app module:

   ./gradlew :app:dependencies --configuration releaseRuntimeClasspath | grep -i -E 'ads|vungle|liftoff|mediation|admob|applovin|unity|ironsource'
   

   On iOS, check Podfile.lock or Package.resolved:

   grep -i -E 'ads|vungle|liftoff|mediation|google-mobile-ads' Podfile.lock
   jq -r '.pins[] | "\(.identity) \(.state.version)"' YourApp.xcworkspace/xcshareddata/swiftpm/Package.resolved | grep -i ads
   

2. Know which demand partners your mediation stack allows. If your ad stack let Discover-Tech bid through any of the exchanges named in the report, your users may have seen its tags. Ask your ad partners for their Discover-Tech exposure and their block date.

3. Restrict what creatives can do. Render HTML creatives in a sandboxed web view without JavaScript bridges to native code, keep file access off, and disable addJavascriptInterface style bridges for ad views. The security vendor's report recommends SafeFrame or sandboxing for third party creatives on the web.

4. Minimise what you pass into bid requests. Do not forward precise location or extra identifiers you do not need. Citizen Lab's whole targeting model depends on the data in the auction.

5. Keep SDKs current, with an SBOM per release so you know which version shipped where.

What would have helped

AdFection was not stopped by any single control, and nothing here would have made a targeted person safe against a well-funded operator on its own. But several ordinary practices cut the exposure sharply.

Ad blocking on managed devices and at the gateway. US agencies recommended it in 2018 and 2020, per Citizen Lab, and Australia's Essential Eight requires browsers not to process web ads. Network level blocking matters most, because most of this activity was in apps.

Advertising IDs off on work phones. Citizen Lab says blocking advertising identifiers directly blocks Discover-Tech's current method. It is an MDM setting, not a project.

Long, searchable DNS and proxy log retention. Al Jazeera's network logs from the attack period gave Citizen Lab the timing signature. A team with a year of resolver logs can answer "did we touch these domains" today; a team with 30 days cannot.

Protective DNS on every network path, including VPN, guest Wi-Fi and phones, with browser DoH routed to it or disabled, and hardened profiles (Lockdown Mode or Advanced Protection, prompt updates) for journalists, officials and others at high risk.

Third party code inventory for your own apps: which ad SDKs, which versions and which demand partners, per release.

Builder hygiene of the kind Controlium lacked. Validate the identity provider's signed token on every request, never ship decryption keys to the browser, and never leave log endpoints or databases open. Those flaws are what let researchers see inside this operation, and they are common in ordinary software.

Zero-Day Discovery and Gold

Safeguard's Zero-Day Discovery looks for previously unknown flaws in open source packages before a CVE exists. It runs in an agentic mode and a deterministic scanner mode, issues findings as SGZ advisories before they reach public CVE databases, and covers seven package ecosystems. It did not find anything in this incident, and it would not be expected to: the attack ran through an ad platform, and the exploits behind it target browsers and operating systems, which are outside the package ecosystems Zero-Day Discovery covers.

Gold Open Source at gold.safeguard.sh is free and needs no login: searchable CVE intelligence with CVSS, EPSS, CISA KEV status, affected and fixed versions and a recommended safe version, a free read API and a CI gate GitHub Action. Gold Registry at registry.safeguard.sh is a paid service providing hardened drop in components and container images held to zero exploitable critical or high CVEs, with SLSA L3 or higher provenance, Sigstore signatures and evidence pages; an artifact loses its badge if it regresses. AdFection has no CVE, and no Gold build would have changed whether a Discover-Tech ad rendered on someone's phone. The habit Gold supports, pulling known good, signed components from a curated source and rebuilding fast, is what lets an app team change an SDK across every release line quickly.

Where Safeguard fits

Safeguard is not an ad blocker, a DNS filter, an MDM or an endpoint detection tool, and it does not look at ad traffic. For the defensive steps above, the tools that matter are your resolver, your MDM and your EDR. Safeguard would not have prevented AdFection, and we do not claim it would have.

Where it helps is with the software you build, which is where the "ad SDK as third party code" lesson lands:

• SBOM and dependency scanning of repositories, container images and SBOM files (safeguard scan --dir ., safeguard scan --image <name>, safeguard scan --sbom <file>, with JSON results under ./output). For Android apps built with Gradle, that inventory includes the ad and mediation SDKs and their versions. The platform shows which projects contain a given component and version, so "which of our apps ship this ad SDK, and which version" becomes a query rather than a survey. Check which iOS package managers your setup covers; if CocoaPods or Swift Package Manager are not in your scan, keep the Podfile.lock inventory from the step above.
• Vulnerability matching and reachability analysis for the SDKs and libraries in those apps, so a real CVE in an ad or web view component is ranked by whether your code calls it.
• Policies and gates evaluated in the platform, so a component version your team has decided not to ship fails the build.
• Autonomous remediation that opens fix PRs for vulnerable dependencies, off by default.
• The Safeguard CLI's assistant, which edits code and runs commands with your approval under /permissions modes Ask, Accept edits, Plan, Auto (the default) and Strict. You could ask it to find every ad view in an Android app, turn off JavaScript bridges and file access on them, and run the tests, approving each change. safeguard exec runs the same kind of task in CI, and the desktop and phone apps can send work to a computer running the CLI and approve each command.

What Safeguard does not do here: it does not detect spyware, inspect ad creatives, block domains, manage advertising IDs or tell you whether a device was infected.

Common mistakes and troubleshooting

Treating an impression as an infection. A hit on mtrtb[.]com means an ad rendered and probably profiled the device. It does not mean spyware. Escalate on validator or C&C contact, not on tracking pixels alone.

Treating no hits as all clear. The public IOC list is partial. Citizen Lab found 305 validator domains but the sources we fetched name only a few. CloudFront hosts rotated every few days. The SDK used DoH and raw IPs. And log retention may not reach 2024.

Blocking cloudfront.net or amazonaws.com wholesale. Block the specific hostnames. Blocking the parent domains breaks large parts of the web.

Relying on browser extensions. About three quarters of the bids were for in-app inventory. Extensions do not see in-app ads. Use network level blocking.

Forgetting DoH and phones off VPN. Browser DoH bypasses both your blocklist and your DNS logs, and a phone on home Wi-Fi does not use the office resolver unless an always-on VPN or DNS profile sends it there.

Resetting instead of deleting ad IDs. A reset gives a fresh ID that can be relinked. Deleting or denying tracking returns zeros.

Hunting only for the 2021 DLL name. The 2026 sample uses a COM hijack with different DLLs. Hunt by hash and by anomalous COM registrations, not by IMJPUEXP.DLL alone.

What changed since first reports

• Australia. iTnews on 16 October named ANSTO and the Australian Synchrotron among networks that received the ads; ANSTO said it had not identified any impact. The security vendor's data did not show Australia among the nine Candiru handoff countries.
• Google's lists. PPC Land confirmed on 18 October that provider ID 3036 was gone from Google's public file.
• IAB Europe. Its response reached Citizen Lab on 15 October and was published separately. Secondhand reports describe a suspension pending remediation rather than a permanent expulsion; we could not fetch IAB Europe's own text to confirm the terms.
• Journalists versus devices. Some coverage says 45 journalists. Citizen Lab's report says at least 45 devices within Al Jazeera. Al Jazeera's own article says 45 devices used by its staff. Devices is the precise term.
• When. Citizen Lab says the Al Jazeera attacks ran in 2024 and 2025. Al Jazeera's article places the 45-device targeting in June 2025 and says unusual patterns were first noticed in 2024.
• Scale estimates. The security vendor estimates about 10 million Discover-Tech impressions a day worldwide. Citizen Lab's database shows 441,954,291 wins over roughly four months for MyDSP alone. These are different datasets and methods, and neither is a count of infections.

Open questions

• Which exploits followed the ad? Neither report publishes the browser, app or operating system exploits used in 2024 to 2026. Until they are known, nobody can say which patches closed the path.
• How many devices went beyond profiling? Citizen Lab counts 3,637,213 "eligible users" on one endpoint in early 2026 but notes not all were necessarily intended for infection or for Candiru. Infection is confirmed only at Al Jazeera.
• Mobile infection. The recovered sample is a Windows DLL. Most bids were for in-app inventory. The reports do not show a mobile implant.
• DARK CARTOGRAPHER. Citizen Lab promises a separate report on carrier flaws used to unmask phone numbers.
• Remaining routes. Whether Discover-Tech still has any way to buy ad space is not confirmed in the sources.
• The other validator domains. Only a few of the 305 are public in the sources we fetched.

FAQ

What is AdFection?

AdFection is Citizen Lab's name for delivering mercenary spyware through targeted ads. An ad wins an auction, renders, and quietly asks the operator's server whether this device is a target. Most devices get nothing back. Chosen devices get JavaScript that sends them toward Candiru's infection servers, with no click.

Who was confirmed infected?

Citizen Lab confirms, with high confidence, that devices at Al Jazeera were targeted and infected with Candiru spyware via Discover-Tech ads, at least 45 devices in 2024 and 2025. Other organisations named in coverage had ad impressions on their networks, which Citizen Lab says is not proof of targeting or infection.

Our network shows up in the impression lists. Were we hacked?

Not necessarily. Search your DNS and proxy logs for the validator and C&C domains in the Technical details section. Tracking domain hits mean profiling likely happened. Validator or C&C hits on a device justify full incident response on that device.

Does an ad blocker protect me?

A browser ad blocker helps on the web but does nothing for ads inside apps, which were about 76.7% of Discover-Tech's bids. Network level blocking through DNS covers apps too. Turning off the advertising ID removes the main identifier Controlium targeted, though IP-based targeting still works.

Is there a CVE or patch for AdFection?

No. AdFection abuses how ad auctions and rendering work. The exploits used after the ad in 2024 to 2026 have not been published. The 2021 Candiru chain used CVE-2021-31979 and CVE-2021-33771 in Windows, patched on 13 July 2021, and Chrome flaws CVE-2021-21166 and CVE-2021-30551.

What is Candiru now called?

Citizen Lab says Candiru now operates as Integrity Labs, a rebrand dating to December 2024, and its summary describes the company as reportedly now US-owned. The Record notes that the US Commerce Department blacklisted Candiru in 2021.

What did the ad industry do?

Google cut Discover-Tech's exchange access in early October, removed it from its vendor lists and added Safe Browsing warnings. IAB Europe removed it from the Global Vendor List on 8 October. Vungle (Liftoff) paused access, Beeswax removed it, and Eskimi blocked it permanently. Some companies did not respond within Citizen Lab's timeline.

I build a mobile app with ads. What should I do?

Inventory your ad and mediation SDKs and versions per release, ask your ad partners about Discover-Tech exposure, render creatives in sandboxed views without native bridges, and send as little data into bid requests as your business allows. Treat the SDK as third party code that renders content chosen by strangers.

Would Safeguard have stopped this?

No. Safeguard does not block ads, inspect creatives or detect spyware. It can inventory the ad SDKs in your own apps, rank real vulnerabilities in them, gate versions you have decided not to ship, and help your engineers change ad view settings with an approval step for each command.

Fix it without waiting for upstream

AdFection itself has no patch, but the apps that render these ads are built from SDKs and libraries that do get vulnerabilities and fixes. When one of those components needs to change across every app and release line, the gaps below are where the time goes.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would have helped

None of these demos shows AdFection, Discover-Tech or an ad SDK. Each is a real Safeguard session, and each intro says how the same flow applies to the work above.

This real CLI session fixes a lodash CVE in a sample repository: the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, and pushes nothing. For AdFection, you would open the CLI in your Android app's repository and ask it to list the ad and mediation SDKs with their versions, find every ad web view, turn off JavaScript bridges and file access on them, and run the tests, approving each edit and command.

Click through it at your own pace, or open it full screen.

This real desktop app session shows the CLI session in the conversation list, a request for work on your computer, a folder pick, and Approve or Deny on each command and file edit, ending with an upgrade done and tests passing. Here you would pick the folder that holds your resolver or gateway configuration and ask for the published AdFection domains to be added to the blocklist and the config checked before reload, approving or denying each change yourself.

Click through it at your own pace, or open it full screen.

This real Android session sends work to a computer running the CLI and approves the command on the phone with Allow once, Allow for turn or Deny. Reports like Citizen Lab's land at all hours; with this flow, the engineer who reads it on a phone can start the log search against the IOC file on a work machine and approve each command before it runs.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI docs. For finding affected products quickly once you know what to look for, read SBOM incident response: finding affected products fast, and for the rest of the month, October 2026 security incidents and what would have helped and edge device zero-days in October 2026.

Quick check

Sources

• Citizen Lab Report 195: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (15 Oct 2026)
• Citizen Lab: Exposing AdFection, executive summary (15 Oct 2026)
• A security vendor's report: ADINT, weaponized ad tech for zero-click spyware and mass identity vacuuming (15 Oct 2026)
• Citizen Lab: Hooking Candiru, another mercenary spyware vendor comes into focus (15 Jul 2021)
• The Record: zero-click spyware delivered through online ads (15 Oct 2026)
• Al Jazeera: how an Israeli firm's zero-click malware attack poses a global security risk (16 Oct 2026)
• iTnews: Australian government and media networks reached by Israeli firm's spy ads (16 Oct 2026)
• PPC Land: Google drops ad vendor it listed since 2020 after 45-device spyware attack
• CISA: Capacity Enhancement Guide, Securing Web Browsers and Defending Against Malvertising for Federal Agencies (PDF)

Last reviewed: 24 October 2026. This is a developing story; check the linked advisories for the latest status.