Skip to content
Discover-Tech's AdFection Scheme Delivers Candiru Spyware via Ads

Discover-Tech's AdFection Scheme Delivers Candiru Spyware via Ads

First seen 17 Oct 2026, 17:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •Discover-Tech's AdFection scheme uses ads to deliver Candiru spyware without user interaction.
  • •At least 45 devices at Al Jazeera were confirmed infected between 2024 and 2025.
  • •The ad network reached sensitive institutions, highlighting vulnerabilities in digital advertising.

A recent investigation by Citizen Lab revealed that Israeli ad firm Discover-Tech operated a spyware delivery scheme named AdFection, utilizing its Controlium platform to infect devices through malicious ads. The scheme targeted users by advertising ID, cookie, or IP address, deploying spyware from Candiru once an ad was loaded. Between 2024 and 2025, at least 45 devices belonging to Al Jazeera were compromised. Discover-Tech's ads reached various sensitive networks, including those of the U.S. Department of Defense and other critical institutions, raising significant cybersecurity concerns. The investigation documented over 3.7 billion advertising bids and linked Discover-Tech to a broader vulnerability in the digital advertising ecosystem. The U.S. government has previously sanctioned Candiru for its role in espionage activities against journalists and activists. The findings suggest that the ad delivery infrastructure can be exploited to bypass traditional cybersecurity measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
Citizen Lab publishes findings on AdFection
The report details Discover-Tech's use of ads to deliver spyware, confirming attacks on Al Jazeera devices.
Debuglies
2026-10-17
Discover-Tech's operations linked to Candiru
Reports reveal the scale of Discover-Tech's ad delivery system and its connection to spyware attacks.
Startupfortune
Recent
U.S. sanctions against Candiru
The U.S. Treasury sanctioned Candiru for supplying spyware tools used against journalists and officials.
home.treasury.gov

More articles in this cluster (5)

Following this threat?

Track Candiru, DarkSword and Al Jazeera in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (34)

1 / 3

Common questions

What is the AdFection scheme?
AdFection is a spyware delivery method using online ads to target specific devices without user interaction.
Which organizations were affected?
At least 45 devices at Al Jazeera were confirmed infected, with ads reaching sensitive networks like the U.S. Department of Defense.
What actions are being taken against Discover-Tech?
The U.S. government has sanctioned Candiru, and major ad platforms have removed Discover-Tech from their registries.