AdFection Myths and Facts
Common misconceptions about AdFection, corrected against the documented evidence. Each myth is paired with the factual position supported by primary research.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
120,768 websites were hacked.
The research reported that relevant advertisements appeared on those sites; that is not equivalent to those websites themselves being compromised.
Every person who saw the ad received Candiru.
The infrastructure selectively returned additional code to chosen users; non-targets received benign or empty responses.
AdFection proves a new iPhone zero-day.
The complete exploit chain has not been publicly established. Do not make this statement unless new forensic evidence establishes it.
AdFection and DevilsTongue are the same thing.
AdFection describes a delivery/targeting technique or pipeline; DevilsTongue refers to Candiru-associated spyware identified by Microsoft.
75,373 apps were malicious.
Ads containing attacker-related script tags were reportedly displayed through those apps. This does not mean the apps were malicious or their publishers complicit.
An ad impression means the device was infected.
An ad impression is not profiling; profiling is not target selection; target selection is not exploit delivery; exploit delivery is not successful compromise.
Last updated 2026-10-18
