Exposing AdFection: How Discover-Tech turned targeted advertising into a delivery pipeline for zero-click mercenary spyware

Citizen Lab published an investigation report stating that between 2024 and 2025, at least 45 devices of the international news organization Al Jazeera were infected through targeted advertising with zero-click mercenary spyware linked to Candiru, and the research team named this technique AdFection. The report states that the Israeli company Discover-Tech operated as a legitimate advertiser, and its Controlium platform could de-anonymize specific users at ad render time, perform device fingerprinting and deliver code. About 4 billion bid records show that its ads appeared on nearly 200,000 websites and Android/iOS apps over four months. Google and IAB Europe have removed Discover-Tech from their ad vendor lists, and Google terminated its access to its ad exchange.