Most people see mobile ads as a minor annoyance that pays for free apps and websites. Behind each ad, though, sits an auction that shares data about the device seeing it, and that data has value of its own. Collected and sold as advertising intelligence (ADINT), it can reveal where a device is, which network it is on, and who is likely to be using it. On 15 October 2026, Citizen Lab published research showing that the same system can also be used to deliver spyware.
What Citizen Lab found
Citizen Lab found that devices at the international news network Al Jazeera were infected with spyware from Candiru, the Israeli vendor that has since rebranded as Integrity Labs. At least 45 Al Jazeera devices were targeted in attacks during 2024 and 2025. The user did not need to click anything, because simply displaying the ad was enough to start the infection. Citizen Lab calls this technique AdFection, and describes it as the first public technical confirmation of zero-click mercenary spyware delivered through targeted ads.
Candiru has been known to researchers for some time. Citizen Lab first documented its attack chain in 2021, and assessed the sample recovered from Al Jazeera as a newer version of that chain. Confiant published a parallel investigation on the same day.
How the AdFection attack worked
Every time an app or website shows an ad, a real-time auction takes place. The device sends a bid request containing details such as device identifiers, IP address, and location. Advertisers then bid, and the winning ad is delivered, all in under a second. These auctions happen hundreds of billions of times a day on exchanges run by companies including Google and Yandex.
According to Citizen Lab, an Israeli company called Discover-Tech presented itself as a legitimate ad buyer but operated as a facilitator for several mercenary spyware vendors, including Candiru. Its ads carried a script that contacted Discover-Tech’s own server when the ad rendered. That server checked the device’s advertising identifiers and IP address.
For most devices it returned nothing, while for selected targets it returned code. Network logs from Al Jazeera showed infected devices contacting Discover-Tech’s infrastructure first, then a Candiru validator server that checked the device, and finally a Candiru command and control server.
Controlium: the targeting console behind the ads
Citizen Lab also examined Controlium, a Discover-Tech platform that gives customers a control panel for these malicious “controlled ads”. Customers can choose whom to target by mobile advertising ID on iOS or Android, by browser identifier, or by IP address. Administrators can also restrict which countries each customer is allowed to target. Further modules show recent bid requests and ad impressions for a given identifier, which can be used to monitor a target’s activity.
A separate threat actor, which Citizen Lab calls DARK CARTOGRAPHER, used Discover-Tech’s infrastructure to run ads that tried to reveal the real IP addresses of VPN and proxy users and to unmask the phone numbers of mobile users. Citizen Lab reports that this actor’s infrastructure links to a mercenary adtech vendor and a US government contractor, and says a fuller report will follow.
Why mobile devices are in scope
The implant recovered from Al Jazeera was a Windows file, and the report does not confirm a mobile implant. However, the channel used to deliver and profile targets is overwhelmingly mobile. About three quarters of Discover-Tech’s bids were for ads inside mobile apps. Over four months, ads carrying its attacker script appeared in more than 75,000 Android and iOS apps, including mainstream messaging, email, weather, and gaming apps.
Even when no spyware was delivered, the ads still sent data back to Discover-Tech. In the UK, Citizen Lab recorded ID-syncing requests to Discover-Tech domains during a visit to The Guardian’s website. Its ads also appeared on government, defence, and critical infrastructure networks across Europe.
After Citizen Lab’s disclosure, Google, IAB Europe, Beeswax, and Eskimi cut off Discover-Tech’s access, and Vungle (Liftoff) paused it pending review. The wider lesson for security teams is that every ad request shares data about the device, and ADINT turns that data into a targeting tool.
How Corrata limits ADINT exposure
Over the past year, Corrata has treated ADINT as a real threat, and we have explained how the ad economy harvests location data from employee devices. In a typical week, Corrata blocks between 1,000 and 2,000 different advertising domains in real time across our platform. These range from well-known ad vendors to obscure services that often go unnoticed.
Turning off the mobile advertising ID on a device helps, but other details such as IP address, location, and operating system version can still be shared with ad services. With Corrata, you can block access to these domains completely, so this information is not shared with third parties. Alternatively, you can allow the domains and report on them, giving you visibility of the ad domains that websites and apps use to collect data.
Corrata also scans the apps on employee devices for background location tracking, which it classes as a potentially dangerous permission. It alerts the user and, if the issue is not addressed, can quarantine the device until action is taken.
To find out how exposed your organisation’s mobile devices are to ADINT, request a demo of Corrata and talk to our team.
