The Mercenary Spyware Supply Chain: Integrity Labs, Candiru, and the AdTech-Exploit Convergence

The convergence of adtech and mercenary spyware

The AdFection campaign documented by Citizen Lab in October 2026 reveals something strategically significant about the modern mercenary spyware industry: it is no longer just about exploit developers and implant operators. The offensive supply chain now includes adtech companies that provide targeting infrastructure, advertising intelligence platforms that identify and track targets, and the traditional exploit and implant developers who deliver the final compromise.

This convergence is what makes AdFection possible. Discover-Tech, an adtech company, provided the targeting and delivery infrastructure through its Controlium platform. Candiru, operating as Integrity Labs, provided the exploit chain and the DevilsTongue implant. Confiant's analysis suggests the advertising JavaScript layer included its own sophisticated C2 mechanism using ECDH-derived shared secrets. Each component is a specialized part of a larger offensive supply chain.

The significance of this convergence is that it lowers the barrier to entry for mercenary surveillance. An operator does not need to build all of these capabilities in-house. They can leverage existing adtech infrastructure for targeting, contract with exploit developers for the compromise stage, and use established implant frameworks for the surveillance phase. This modularization makes the overall capability more accessible and more resilient.

Mapping the offensive ecosystem

The AdFection supply chain includes several distinct roles. Discover-Tech served as the adtech bridge, providing access to the programmatic advertising ecosystem and the Controlium targeting platform. Candiru, now reportedly operating as Integrity Labs, provided the exploit chain and the DevilsTongue Windows implant. The advertising JavaScript layer, analyzed by Confiant, included fingerprinting, cookie-reading, and an ECDH-based C2 mechanism for encrypted tasking.

Citizen Lab also uncovered links between Discover-Tech and additional actors. Bindecy is an Israeli mercenary surveillance company that develops surveillance tools, and Citizen Lab identified infrastructure associated with it. Intelos is an advertising-intelligence company with links to the operation. The leaked Controlium control-panel credentials revealed users associated with Candiru, Integrity Labs, Bindecy, and Intelos, suggesting the platform served multiple mercenary surveillance customers.

Citizen Lab also identified a separate actor it calls DARK CARTOGRAPHER, which allegedly used advertising infrastructure and weaknesses in mobile-network systems to associate advertising identifiers with telephone numbers. A dedicated report on DARK CARTOGRAPHER is forthcoming, which may reveal another layer of the offensive ecosystem focused on identity resolution through telecommunications infrastructure.

Integrity Labs and the continuity of capability

The reported rebranding of Candiru as Integrity Labs is relevant to the supply chain analysis because it demonstrates how the offensive capability persists through corporate restructuring. Recorded Future identified Integrity Labs Ltd, incorporated in December 2024, during its investigation of Candiru's DevilsTongue infrastructure. Israeli media reported a 30 million dollar acquisition by U.S.-based Integrity Partners in 2025.

From a supply chain perspective, what matters is that the capability did not disappear when the corporate name changed. The DevilsTongue infrastructure continued operating through 2025, and the AdFection campaign in 2026 demonstrates continued offensive innovation. The delivery method evolved from previous techniques to a new advertising-based pipeline, which means the research and development function behind the operation remained active.

Candiru was added to the U.S. Entity List in November 2021, which restricts access to U.S. technology. The question of whether Integrity Labs as a successor entity is subject to the same restrictions is legally unresolved, but the operational reality is that the capability continued to function and innovate despite the Entity List designation. This suggests that the supply chain has adapted to work around regulatory restrictions, possibly through the corporate restructuring itself.

The ADINT layer: advertising as an intelligence sensor

The offensive supply chain includes an intelligence layer that uses the advertising ecosystem as a sensor. ADINT, or advertising intelligence, is the collection of advertising-derived data for intelligence purposes. The advertising ecosystem leaks enormous amounts of information about devices, including IP addresses, device types, locations, app usage, and behavioral patterns.

Confiant's analysis of the AdFection infrastructure documented code capable of harvesting extensive browser and device signals, including mouse movement, clicks, keyboard timing, scrolling, touch events, navigation behavior, and visibility state. In some advertising contexts, the code was capable of reading accessible first-party cookies, including session identifiers and identity-related information.

This moves the offensive architecture toward a pipeline that proceeds from ADINT to identity resolution to device discovery to validation to exploit delivery to spyware. Each stage uses a different part of the advertising ecosystem, and the overall pipeline converts the global advertising infrastructure into a distributed worldwide surveillance and malware-delivery network. The offensive significance is that this infrastructure already reaches nearly every internet user, which means the attack surface is the entire advertising layer of the internet.

What this means for the future of targeted surveillance

The AdFection supply chain model has implications that extend beyond a single campaign. The architecture is replicable, which means other operators could build similar pipelines using different adtech companies, different targeting platforms, and different exploit developers. Citizen Lab notes that Google and several advertising companies took enforcement actions against Discover-Tech, but the architecture itself is not eliminated.

The offensive innovation in AdFection is not a new exploit or a new implant. It is the integration of existing capabilities, adtech targeting, advertising intelligence, exploit delivery, and mercenary spyware, into a single pipeline. This integration is what makes it strategically significant, because it demonstrates that the pieces can be assembled into a working zero-click delivery system using infrastructure that already exists at internet scale.

For defenders, this means the threat model must account for the advertising ecosystem as an attack surface, not just as a privacy concern. For high-value targets, the defensive posture must include blocking advertising infrastructure, monitoring for connections to known threat infrastructure, and recognizing that zero-click spyware can now arrive through channels that were previously considered benign. The supply chain convergence means that the attack surface is broader and more distributed than ever before, and that tracking these operations requires following the infrastructure and the capabilities across corporate boundaries.

Frequently asked questions

Related research