bk99.de entertain the web since 1997

bk99.de
Citizen Lab · SecurityCurated

AdFection: when an ad is enough to install spyware

Summary

Citizen Lab and Confiant have provided the first technical proof that targeted online advertising is used to install spyware on devices without any click, and call the method AdFection. The Israeli company Discover-Tech bought ads via Google, Yandex and other ad exchanges and handed selected targets over to spyware vendors such as Candiru; at Al Jazeera, at least 45 devices were attacked this way. The investigation shows how real-time auctions, advertising IDs and third-party code in ads together form an attack surface against which ad blockers are so far the main defence.

What happened

The Citizen Lab at the University of Toronto and the security company Confiant published coordinated reports on Discover-Tech on 15 October 2026. Founded in 2020, the company presented itself as an ordinary advertising service provider, was listed as a “certified” vendor by Google and IAB Europe and bought ads via Google, Yandex, Vungle, Sunteng, Eskimi and Comcast’s Beeswax. According to Citizen Lab, its real purpose was to give spyware firms access to the advertising system.

The proof came from Al Jazeera: the broadcaster provided network logs from 2024 and 2025. For at least 45 devices, the same sequence appears every time: first contact with Discover-Tech servers, i.e. an ad, then with a Candiru validator server and finally with a command server. A DLL was recovered from an infected Windows machine, which Citizen Lab classifies with high confidence as a newer version of the Candiru software the lab had already analysed in 2021. Another trail leads to Saudi Arabia’s Ministry of Foreign Affairs.

How online advertising works technically

Behind almost every ad is a real-time auction (real-time bidding) that takes less than a second and happens hundreds of billions of times a day worldwide. The app or website sends a bid request to ad exchanges via a supply-side platform (SSP), advertisers bid via a demand-side platform (DSP), and the winner delivers the ad. The bid request often contains the phone’s advertising ID, cookie IDs, IP address, location, device model and the app in use.

Two properties make the system attractive to attackers: it allows targeted bidding on individual people based on such identifiers, and an ad is not just an image but may bring HTML and JavaScript that runs in the browser or app. Whoever bids on the right advertising ID can therefore get their own code onto exactly one specific device.

The attack path step by step

Many Discover-Tech ads contained a script tag that, when displayed, queries a server of the company’s own (internally called “NOAS”) with the advertising ID and IP address. For almost all users this server replies with 0 bytes, and the ad looks harmless. Only for selected targets does it deliver JavaScript once, such as an invisible 1×1 iframe pointing to an address of the spyware customer. Because the malicious code is never in the ad itself, the ad exchanges’ checking tools saw nothing suspicious.

Discover-Tech appended the victim’s IP address in encrypted form to the forwarded address. This lets the attacker check that the selected device really arrives and not a security researcher who intercepted the link. Confiant analysed an obfuscated “SDK” of around 90 KB: it negotiates a key with the server via ECDH, asks for commands once per second, collects device and behavioural characteristics and executes arbitrary downloaded code with new Function(). A helper command resolves domains via DNS over HTTPS and connects directly by IP so that DNS filters see nothing.

Neither report was able to secure a complete exploit chain publicly. In the past, however, Candiru used zero-day vulnerabilities in Chrome, such as CVE-2021-21166 and the WebRTC flaw CVE-2022-2294.

Controlium: the control centre with astonishing holes

Through the Controlium platform, customers selected targets by Android and iOS advertising IDs, cookie IDs or IP addresses, saw their targets’ bid requests and ads from the last 30 minutes and could allow or block countries. The operator itself was careless: the entire frontend code sat on the login page, the login token could apparently be forged with a key published in the code, and an endpoint without authentication delivered login logs of 120 users over 128 days.

Two openly accessible Apache Druid databases contained almost four billion bid records. The login data allowed customers to be identified: users linked to Candiru (now “Integrity Labs”), to the spyware firm Bindecy and to the ADINT vendor Intelos, which sells advertising data for location tracking.

The scale

From March to June 2026, Discover-Tech’s MyDSP platform bid on around 3.77 billion ad slots and won about 442 million of them, three quarters in apps. The ads appeared in more than 70,000 apps and more than 120,000 websites. About 19 percent of the bids concerned ads with the script tag pointing to the control server, and only around 109,000 US dollars were spent on them. The researchers found no real advertisers: the ads promoted the company’s own services such as MyIPInfo or showed a generic AliExpress motif without revenue and without conversions.

According to BR and netzpolitik.org, the ads also ran in WetterOnline, Duolingo, Viber, Grindr and Badoo; at WetterOnline, Discover-Tech was listed among more than 800 data partners in the privacy policy until February 2025. Ads were also served in the networks of NATO, the UN, the European Parliament and the European Commission and, according to Confiant, the US Department of Defense, the IAEA and the International Criminal Court. An ad there does not mean an infection, but it does mean the device was recorded.

Confiant also observed on more than 1,000 websites that ads read the page’s entire cookie jar when they did not run in an isolated iframe, sometimes including session IDs of logged-in users, even without GDPR consent.

DARK CARTOGRAPHER: phone numbers from advertising

Another actor used the same infrastructure to link advertising IDs with phone numbers. The ads exploit weaknesses in mobile carriers’ “zero-click login”, where the network attaches the phone number as a header to unencrypted HTTP requests, as well as the WebRTC leak, which can reveal the real IP address of VPN users. Carriers in more than 30 countries are affected, probably since at least 2019; a separate report is to follow once the disclosures to the carriers are complete.

Why the advertising industry failed

Discover-Tech was on the vendor lists of Google and IAB Europe from 2020 until October 2026, although links to the spyware industry could be read in company registers. According to Citizen Lab, admission is based mainly on self-declarations. Eskimi stated that the tags loaded different code depending on device, IP address and location and thereby passed third-party verification.

After the researchers’ notifications, Google, IAB Europe, Beeswax, Vungle and Eskimi cut off access in early October. Discover-Tech, Candiru, Bindecy and Intelos did not respond. According to BR, Germany’s Federal Office for the Protection of the Constitution sees “considerable potential danger”, because state-controlled attackers can reach targets this way without depending on a mistake by the victims.

What admins and users can do

NSA and CISA have recommended for years that government agencies block advertising; Citizen Lab currently considers filtering at the network gateway the most practical protection. For organisations, this means blocking ads and tracking centrally with DNS or proxy filters, disabling the advertising ID on work devices via MDM and using browsers with tracking protection. Because the SDK can use DNS over HTTPS, a DNS filter should be complemented by blocking external DoH servers.

Anyone running a website with ads should only deliver ads in isolated iframes (SafeFrame) and mark session cookies as HttpOnly. For private users, an ad blocker in the browser, a filter on the router, resetting or disabling the advertising ID and prompt browser updates help, because in the end the attack needs a vulnerability in the browser or app.

Ideas

  • Targeted advertising makes it possible to get your own code onto exactly one selected device.
  • The malicious code is not in the ad but only comes from the server for targets.
  • The victim’s IP address is passed along encrypted to lock out researchers.
  • Advertising ID, cookie ID and IP address serve as target coordinates.
  • Open databases and unauthenticated endpoints revealed the scale and the customers.
  • Phone numbers can be linked to advertising IDs via header enrichment in mobile networks.
  • Ad blockers at the network gateway work as a security measure, not just a convenience.

Insights

  • Where every ad may run third-party code, advertising is a distribution channel for malware.
  • Certifications based on self-declaration create trust without verifying it.
  • Data trading for advertising and state surveillance use the same infrastructure.
  • Checking ads only automatically misses attacks that behave differently depending on the viewer.

Facts

  • At Al Jazeera, at least 45 devices were attacked via Discover-Tech ads in 2024 and 2025.
  • From March to June 2026, Discover-Tech won around 442 million of 3.77 billion bids.
  • The ads ran in more than 70,000 apps and more than 120,000 websites.
  • Discover-Tech was listed as a vendor by Google and IAB Europe from 2020 until October 2026.
  • From January to June 2026, a Discover-Tech server counted 3,637,213 users earmarked for additional code.

References

Critique

  • Neither report shows which browser or system vulnerability actually infected the devices at Al Jazeera; the attribution rests on the sequence in logs and a recovered piece of malware.
  • Many headlines name NATO, the UN and the EU as targets; what is proven there is only that ads were served, not that devices were infected.

Remarks

  • The researchers only evaluated publicly accessible data and deliberately did not exploit the suspected flaw in Controlium’s login system.
  • The ad data comes only from the MyDSP platform; purchases via Beeswax and Eskimi are not included.

Recommendations

  • Block ads and tracking centrally in the company network and block external DNS-over-HTTPS servers.
  • Disable the advertising ID on work smartphones via MDM and at least reset it regularly on private ones.
  • As a website operator, deliver ads only in SafeFrames and set session cookies as HttpOnly.
  • Update browsers and apps quickly, because in the end the infection needs a security vulnerability.

Read the report

Search the Web Archive

Own project · 2026

SYN-ACK reflection: when your own web server works for someone else’s attack

In October 2026 the firewall log of my home network suddenly showed hundreds of connection attempts to my reverse proxy, all from two networks of a Polish provider. The analysis revealed crafted SYN packets whose replies nobody ever answered, so most likely not an attack on me but on the network of the supposed senders. This post shows how to recognise SYN-ACK reflection, why my country block did not apply and how I drop the packets in OPNsense for a limited time.

fefe · 2020

When security products become a risk themselves

In February 2020, Felix von Leitner collected three reports in which security products themselves became the problem. McAfee bought a browser isolation company, a large provider filtered unusually small network packets on its routers as supposed attack protection and thereby broke, among other things, libraries’ Onleihe e-lending service, and the IOTA cryptocurrency stopped its network after a theft. The common denominator: security is promised but implemented without understanding.

hß · 2005

Security hole in HP server when powered down

In 2005 HP recommended an unusual workaround for the ProLiant DL585 server: pull the power cable. A bug in the Integrated Lights-Out remote management module up to firmware 1.8 allowed unauthorised network access to the server controls while it was switched off. Only without power was the iLO switched off as well, but then every restart required a trip to the server room.