Citizen Lab researchers uncover AdFection, a campaign abusing online advertising infrastructure to deliver spyware automatically upon ad rendering without user interaction.
According to researchers at Citizen Lab, the program appears to be linked to the Israeli company Candiru. The activity was initially detected on devices belonging to the Al Jazeera news organization, where at least 45 devices were affected between 2024 and 2025.
How the trap was set through advertisements
Another Israeli company, Discover-Tech, which operates a platform called Controlium, is said to be at the center of the case. According to the report, the company sold access to its advertising services to creators of surveillance software.
This process worked automatically the moment an ad appeared on the user's screen. The ad code gathered information about the device and communicated with Discover-Tech's computers. This mechanism then connected the ad to the computers of the tracking program's operators, allowing for automatic infection without the user having to click or download anything.
READ ALSO
How an old ad circuit is linked to thousands of fake tech support pages
Researchers dubbed the operation “AdFection.” According to company records accidentally exposed online, Discover-Tech’s ads were displayed on over 120.000 websites and 70.000 mobile apps between March and June 2026. The company served ads through well-known platforms, including Google, Yandex, and Comcast’s Beeswax platform.
Who was at risk and what was the reaction?
The most worrying element of the case is that the suspicious ads appeared on devices located on sensitive national security networks worldwide, such as defense ministries, armed forces, national cybersecurity agencies, organizations such as NATO, and critical infrastructure.
Discover-Tech did not immediately respond to requests for comment. However, following the findings of the investigation, companies and organizations including Google, IAB Europe, Beeswax, Vungle and Eskimi took action to cut off Discover-Tech’s access to the digital advertising system.
Google said it had banned the company from its platforms for violating its rules, adding security warnings to protect users from websites linked to it. Researchers are calling on authorities to investigate whether the companies involved violated the law.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)