Researchers at the University of Toronto's Citizen Lab identified a new spyware delivery method called AdFection. This technique allows malware to infect devices via digital advertisements without requiring any user interaction, such as clicks or link navigation.
The method utilizes the Controlium platform, developed by the Israeli firm Discover-Tech. The platform identifies specific targets using device identifiers during real-time advertising auctions. If a target is identified, the system delivers malicious code while the advertisement loads in the background.
Between 2024 and 2025, at least 45 devices within the Al Jazeera network were compromised using this method. Forensic analysis revealed connections to servers operated by the spyware developer Candiru, including the discovery of a Windows DLL library associated with the firm.
Data from March to June 2026 shows that Discover-Tech ads appeared on over 120,000 websites and 70,000 mobile applications. While millions of devices contacted Candiru servers, these connections were primarily used for data collection and target selection rather than direct infection.
In response to the findings, Google has blocked Discover-Tech from its advertising systems and implemented Safe Browsing warnings. Additionally, the company Beeswax terminated its partnership, and IAB Europe suspended Discover-Tech from its registry of advertising providers.
