AdFection: The Complete Technical Guide to Zero-Click Spyware Delivered Through Targeted Advertising

Definition & historical significance

AdFection is the name Citizen Lab gave to a zero-click mercenary-spyware delivery technique in which targeted online advertising infrastructure can be used to identify selected devices and route them toward spyware infection infrastructure[1]. The report, published October 15, 2026, is the first public technical confirmation that the programmatic advertising ecosystem — the same infrastructure that serves billions of ads daily across mobile apps and websites — can be used as a delivery pipeline for mercenary spyware.

The term "AdFection" was coined by Citizen Lab researchers. It describes a methodology — a delivery and targeting technique — rather than a single piece of malware. The spyware ultimately delivered through the AdFection pipeline is attributed to Candiru, an Israeli mercenary spyware vendor, with its Windows implant known as DevilsTongue[1,3].

The discovery is historically significant because it closes a gap between two previously separate bodies of research: (1) advertising intelligence ("ADINT") and the surveillance potential of programmatic advertising metadata, and (2) mercenary spyware delivery through exploits and infrastructure. AdFection documents a path that connects them in the wild.

How targeted advertising normally works

Programmatic advertising automates the buying and selling of ad inventory in real time. When a user opens an app or webpage, an ad exchange generates a bid request containing metadata about the opportunity: the device type, operating system, browser, approximate geography, application or site identifier, and — where available — a mobile advertising identifier (IDFA on iOS, GAID on Android) or cookie identifiers. Demand-side platforms (DSPs) evaluate this opportunity on behalf of advertisers and submit bids; the auction is settled in milliseconds and the winning creative is delivered to the device.

This architecture is designed for efficiency and scale, but it also means that a very large number of participants can be exposed to third-party advertising code and tracking infrastructure. Citizen Lab analyzed approximately 3.77 billion publicly exposed advertising bidding records during approximately March–June 2026, reporting that Discover-Tech won roughly 442 million impressions (~11.7% of auctions) across 161 countries by IP geolocation, and that ads containing attacker-related script tags were displayed through 75,373 Android/iOS applications and 120,768 websites[1].

The reach extended into sensitive networks: impressions appeared inside government, defense, health, research, and judicial networks, including NATO, the United Nations, European Union institutions (Parliament, Commission, and Council), national defense ministries, critical infrastructure (power, rail, and nuclear-related facilities), semiconductor and technology firms (such as Intel and Nvidia), and media organizations[1,7]. Citizen Lab estimates that millions of devices were nevertheless silently directed toward Candiru-associated infrastructure, probably for profiling and reconnaissance — the vast majority for profiling, not infection[1].

The AdFection attack chain

Citizen Lab documented a temporal pattern in which devices contacted Discover-Tech advertising infrastructure, then Candiru validator infrastructure, then exhibited additional profiling or infection activity, and finally communicated with Candiru command-and-control (C2) servers — in the documented cases, the validator-to-C2 sequence occurred within roughly 1–3 minutes of the initial ad impression[1]. The reconstructed chain is shown below; each node is expandable.

A defining feature of the chain is that the ad creative itself carried no exploit payload — only a callback to a remote script endpoint. The exploit code was delivered only to matching targets after the NOAS check, so ad-exchange review systems and automated scanners, which sample creatives from non-target contexts, saw only an ordinary ad[1,7]. On selected targets the returned JavaScript could open a hidden 1×1-pixel iframe or otherwise hand off to Candiru infrastructure, ultimately delivering a browser (or related) exploit that installed the Candiru Windows implant — a newer build of the 2021 chain. The specific vulnerability used in the Al Jazeera infections was not publicly disclosed.

Discover-Tech & Controlium

Discover-Tech is the advertising-technology company identified in the 2026 investigation as operating infrastructure that participated in the ad-delivery path. Discover-Tech bid in the normal real-time ad auction through platforms including its MyDSP (and other DSPs); when it won, its ad was pushed to a website or app open on the target device. Controlium is the targeting platform associated with Discover-Tech that researchers reconstructed; it supports targeting based on mobile advertising identifiers, browser cookie identifiers, and IP addresses, and gave spyware customers a control panel to upload target lists and control when code was returned[1]. The Controlium platform integrates with components researchers labeled NOAS and getAd, which handle selective code delivery to chosen devices.

For full technical profiles, see the Discover-Tech pillar and the Controlium pillar.

NOAS / getAd: selective, target-conditioned delivery

The NOAS and getAd components are central to why AdFection is difficult to detect at scale. Conceptually, an ad creative contains a reference to a remote script endpoint. When the ad rendered, the browser or app automatically requested JavaScript from that NOAS (Network On Ad Server / getAd) server and submitted the device's identifiers (a browser cookie ID or mobile advertising ID) plus its IP address. The server then evaluated that request metadata. A request from a non-selected device — or from a security scanner, sandbox, or researcher not reproducing the exact target context — received a 0-byte (empty) response and nothing malicious executed. A request matching a selected target received JavaScript, which could open a hidden 1×1-pixel iframe or otherwise hand off to further Candiru infrastructure[1,7].

This behavior — selective execution, target-conditioned delivery, or cloaking — frustrates automated malware scanners, advertising-review systems, sandbox analysis, security crawlers, and researchers who are not reproducing the exact target context. For a conceptual explainer, see the NOAS and getAd page.

The Al Jazeera investigation

Citizen Lab's AdFection report documents attacks against Al Jazeera during 2024 and 2025, reporting at least 45 devices targeted in those attacks[1]. Detection began with Al Jazeera's own in-house technology team, which noticed unusual device patterns during 2024–2025 and contacted Citizen Lab; the infections were not caught by endpoint antivirus in real time. The investigation recovered a Windows DLL from a compromised device and traced the chain from Discover-Tech infrastructure contact, to Candiru validator, to additional profiling/infection activity, to Candiru C2. See the Al Jazeera case study for the full forensic narrative.

Recovered malware & infrastructure

A Windows DLL was recovered from a compromised device in the Al Jazeera investigation. Its publicly reported SHA-256 hash is shown below as a defensive threat-intelligence indicator. Treat hashes and infrastructure strictly as defensive indicators, not as proof that any given device was compromised.

Four C2 servers cited in the report include:

• fearevolve[.]comHISTORICAL
• insightenterprisells[.]comHISTORICAL
• jobmarcher[.]comHISTORICAL
• plasticbells[.]comHISTORICAL

The recovered malware sample hard-coded fearevolve[.]com and jobmarcher[.]com. Citizen Lab linked the newer sample to earlier Candiru malware through similarities including COM-based persistence characteristics, a distinctive 48-byte XOR string-obfuscation scheme using a dummy null-terminator, hardcoded Google and Microsoft connectivity checks, and overall functional overlap with earlier Candiru chains[1,3]. These characteristics are described for defensive understanding only.

Attribution methodology

Attribution in the AdFection report rests on three converging lines of evidence[1,3]:

1. 1 · Network-log analysis (temporal signature)

   Network logs from Al Jazeera showed a consistent sequence on infected devices: Discover-Tech contact (ad impression), seconds later a Candiru validator connection, and within 1–3 minutes Candiru C2 contact — linking the ad delivery directly to the infection.

2. 2 · Infrastructure fingerprinting

   Citizen Lab developed HTTP fingerprints for Candiru servers (a "V1" fingerprint for validator servers such as keyadapter[.]com and sharethere[.]net), matching HTTP response banners observed on Censys against known and newly identified Candiru infrastructure. Historical research identified 305 validator-associated domains across 319 IPs (Aug 2022–Jul 2026), with the fingerprinting behavior disappearing during May–June 2026.

3. 3 · Recovered malware sample

   A Windows DLL recovered from a compromised device (SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) matched earlier Candiru/DevilsTongue malware documented by Microsoft in 2021 on COM-hijacking persistence, a 48-byte XOR string-obfuscation scheme with a dummy null-terminator, hardcoded C2 domains (fearevolve[.]com, jobmarcher[.]com), and Google/Microsoft connectivity checks.

A critical methodological distinction: an advertisement impression is not profiling; profiling is not target selection; target selection is not exploit delivery; exploit delivery is not successful compromise; and successful compromise is not active C2 communication. The report is careful to distinguish these stages. See our methodology page for how this site applies the same discipline.

Defensive recommendations

Citizen Lab's central defensive recommendation is that organizations handling high-risk personnel should consider blocking advertising and tracking at devices and organizational gateways[1]. This reduces the attack surface presented by programmatic advertising infrastructure. Practical measures include DNS filtering, secure web gateways, browser isolation, MDM policies restricting advertising identifiers, and endpoint telemetry tuned to the behavioral indicators described in the detection and defense guide.

What we know vs what we do not know

Implications

FAQ