AdFection Research Blog: Threat Intelligence on Mercenary Spyware & AdTech Exploitation
In-depth analysis from our research team on AdFection, Candiru, DevilsTongue, Discover-Tech, and Integrity Labs. Written for security professionals tracking the offensive evolution of mercenary surveillance and advertising-based spyware delivery.
- Published
- 2026-10-18
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Our researchers publish technical analysis on the offensive mechanics behind mercenary spyware campaigns, advertising-based exploitation, and the infrastructure that enables targeted surveillance. Every post is sourced, dated, and written for defensive threat intelligence.
RSS FeedAdFection: The Zero-Click Spyware Delivery Method That Changed Mercenary Surveillance
Citizen Lab's October 2026 report confirms that targeted advertising infrastructure can deliver Candiru spyware without a single click. Here is what AdFection is, how the attack chain works offensively, and why it changes the threat model for high-value targets.
Candiru Spyware: Inside the Mercenary Operator Powering AdFection and DevilsTongue
Candiru is the Israeli mercenary spyware company behind DevilsTongue and the AdFection ad-based delivery method. This analysis covers Candiru's history, offensive capabilities, infrastructure, and its 2025 rebranding as Integrity Labs.
DevilsTongue: Technical Analysis of Candiru's Windows Surveillance Implant
DevilsTongue is the Windows implant at the core of Candiru's offensive capability. This technical analysis covers its architecture, capabilities, persistence mechanisms, and the offensive design decisions that make it difficult to detect and analyze.
Discover-Tech: How an AdTech Company Became a Spyware Targeting Infrastructure
Discover-Tech is the Israeli advertising technology company at the center of the AdFection campaign. This analysis covers how its Controlium platform enabled targeted spyware delivery, the offensive capabilities of its URL delivery system, and the scale of its advertising reach.
Integrity Labs: Candiru's Rebranding and the Future of Mercenary Spyware
Candiru has reportedly rebranded as Integrity Labs, with a 30 million dollar acquisition by Integrity Partners in 2025. This analysis covers the corporate rebranding, Entity List implications, and what it means for the future of mercenary spyware operations.
How AdFection Weaponizes Programmatic Advertising for Zero-Click Exploitation
The offensive mechanics behind AdFection: how real-time bidding, selective JavaScript delivery, and advertising-derived targeting combine to create a zero-click spyware delivery pipeline that evades traditional security controls.
Candiru's Attack Playbook: From Sherlock Zero-Click to AdFection Ad-Based Delivery
Candiru has evolved its offensive delivery methods over years, from the Sherlock zero-click vector to the AdFection advertising-based pipeline. This analysis traces the evolution of Candiru's attack techniques and what each innovation reveals about the operator's offensive strategy.
DevilsTongue's Offensive Toolkit: COM Hijacking, Credential Theft, and C2 Architecture
A deep dive into the offensive techniques DevilsTongue uses to maintain persistence, steal data, and communicate with its operators. Covers COM object hijacking, session impersonation, credential access, and the multi-layered C2 infrastructure that makes Candiru's implant difficult to detect and remove.
Controlium's Script Delivery System: The Offensive Engine Behind AdFection Targeting
Controlium's URL delivery system, with its Script, De-anon, and Monitor types, is the offensive engine that makes AdFection's selective targeting possible. This analysis covers how each delivery type supports a specific stage of the attack chain.
The Mercenary Spyware Supply Chain: Integrity Labs, Candiru, and the AdTech-Exploit Convergence
The AdFection campaign reveals a supply chain where adtech companies, targeting platforms, exploit developers, and mercenary operators converge. This analysis maps the offensive ecosystem and what it means for the future of targeted surveillance.
Citation & reuse policy
Our blog posts are published for defensive threat-intelligence purposes. Security professionals, journalists, and researchers are encouraged to cite and reference this work. When citing, please link back to the original post URL on adfection-candiru.shop as the source. No actionable offensive exploit code is ever published.
Last updated 2026-10-18
