Controlium: Technical Analysis of Discover-Tech's Targeted Advertising Platform
Controlium is the targeting and control platform associated with Discover-Tech that Citizen Lab researchers reconstructed from the 2026 AdFection investigation. It supports targeting based on mobile advertising identifiers, browser cookie identifiers, and IP addresses, and integrates with NOAS/getAd infrastructure for target-conditioned code delivery.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
What Controlium is
Controlium is the targeting and control platform associated with Discover-Tech, reconstructed by Citizen Lab researchers from the 2026 AdFection investigation. It is the component that turns the programmatic advertising ecosystem into a selectable delivery mechanism: it maintains target lists, configures controlled ad campaigns, and decides which devices receive additional code — and when. The control panel let spyware customers upload target lists and control when code was returned to matching devices.
How researchers discovered it
Researchers reconstructed Controlium's frontend and behavior through analysis of the advertising infrastructure documented in the AdFection report. The reconstruction is based on observed ad-delivery behavior, bid-request handling, and the selective responses returned to selected versus non-selected devices.
Categories of functionality
Target lists built from advertising identifiers, cookie identifiers, and IP addresses; spyware customers upload audiences to target.
Configuration of controlled ads, delivery parameters, frequency caps, and geographic restrictions.
A control panel to monitor impressions and delivery outcomes in real time.
Selection of devices matching target selectors within the programmatic auction.
Resolution of bid-request metadata to identifiable devices/profiles.
Aggregation of device, browser, and behavioral attributes.
Target-conditioned delivery of additional code to selected devices via NOAS/getAd; operators control when code is returned to matching targets.
Recording of impressions and delivery decisions.
Integration with the NOAS/getAd selective delivery endpoints.
Targeting selectors
| Selector | Source | Surveillance relevance |
|---|---|---|
| Mobile Advertising IDs (MAIDs) | Bid request (IDFA / GAID) | Persistent per-device identifier enabling cross-app tracking; no message delivery required |
| Ad-Cookies | Bid request | Browser-specific persistent identifiers for cross-site identification |
| IP Ranges / CIDR Blocks | Bid request | Target specific office networks or ISPs |
| Browser User-Agent Strings | Bid request | Ensure the exploit chain matches the target's exact environment |
| Geographic Geo-Hashes | Bid request | Target specific cities |
Campaign URL / delivery types
Citizen Lab's reconstruction of Controlium's frontend found a campaign mechanism that allowed operators to define different "URL Types" for a campaign. This is where the orchestration logic lives:
| URL Type | Technical function | Operational purpose |
|---|---|---|
| Ad URL | Serves a standard, benign HTML5/VAST creative. | Fills inventory, masks DSP presence. |
| Script | Injects raw JavaScript directly into the page context. | Delivers the ADINT fingerprinter or the exploit. |
| Monitor | Returns a 1×1 pixel or lightweight JS beacon. | Passive tracking; confirms target is online. |
| Test URL | Used for QA before live deployment. | Validates that the exploit chain works in a specific environment. |
| User Agent | Conditional logic based on the device.ua string. | Ensures the IE/Chrome exploit matches the target's browser. |
| De-anon | Cross-references ad-cookies with other identifiers. | Builds the "Identity Vacuum" to track the user across domains. |
The Script type is particularly significant: Citizen Lab believes it may allow arbitrary JavaScript to be delivered to selected targets — an extremely powerful capability when combined with browser exploitation. The De-anon type points to de-anonymization functionality tying advertising identifiers to real identities.
The scale of the sensor network
Citizen Lab intercepted nearly 4 billion raw bid records from Discover-Tech between March and June 2026. The reach spanned:
Conclusion: The ad network acts as a distributed, continent-scale sensor grid. If a target is in a coffee shop, at home, or in a government ministry, and they are using an app or website connected to a Discover-Tech SSP (Supply-Side Platform), the DSP knows their current IP, their active app, and their device state in real time.
Operational-security mechanisms
Controlium's integration with NOAS/getAd enables selective, target-conditioned delivery: non-target devices and security scanners receive benign or empty responses, while selected targets receive additional code. This cloaking behavior frustrates automated analysis and is a core reason the delivery pipeline is difficult to detect at scale.
Confiant's parallel ad-security research described sophisticated cloaking used by the infrastructure: obfuscated JavaScript, ECDH/AES encrypted channels, DNS-over-HTTPS (DoH), behavioral fingerprinting, and CloudFront hand-offs, combined with large-scale identity vacuuming through cookie matching and first-party cookie theft. Confiant documented code capable of harvesting extensive browser and device signals: mouse movement, clicks, keyboard timing, scrolling, touch events, navigation behavior, visibility state, and other fingerprinting signals — and in some advertising contexts, code capable of reading accessible first-party cookies, including session identifiers and identity-related information.
Leaked control-panel access
Controlium logins were reportedly exposed through an unauthenticated endpoint. The leaked credentials revealed users associated with Candiru/Integrity Labs, Bindecy, and Intelos, supporting the assessment that Controlium functioned as a shared targeting platform for multiple mercenary-spyware actors.
Boundary: This page describes Controlium conceptually for defensive understanding. It does not reproduce a functioning offensive clone or any code enabling unauthorized targeting or malware delivery.
Relationships
- Controlium → MyDSP: integrated within the Discover-Tech DSP/ad-buying path.
- Controlium → NOAS/getAd: delegates selective code delivery to these endpoints.
- Controlium → Candiru: selected targets are routed to Candiru validator infrastructure.
- Controlium → Discover-Tech: the targeting platform operated within Discover-Tech's infrastructure.
- Controlium → Bindecy / Intelos: leaked control-panel credentials revealed users associated with these additional surveillance and ad-intelligence actors, suggesting Controlium functioned as a shared targeting platform.
- DARK CARTOGRAPHER: a separate actor Citizen Lab identified using advertising infrastructure and weaknesses in mobile-network systems to associate advertising identifiers with telephone numbers; a dedicated report is forthcoming.
- [1] Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab, 2026-10-15
- [2] Hooking Candiru: An Analysis of a New Israeli Spyware Vendor — Citizen Lab, 2021-07-15
- [3] DevilsTongue: A New Market for Mercenary Spyware — Microsoft Threat Intelligence, 2021-07-13
- [4] Google TAG research on Candiru zero-day campaigns — Google Threat Analysis Group, 2021
- [5] Return of Candiru (CVE-2022-2294) — Avast / Gen Digital Threat Labs, 2022-07
- [6] Tracking Candiru's DevilsTongue Spyware in Multiple Countries — Recorded Future / Insikt Group, 2025
- [7] ADINT / weaponized ad-tech investigation — Confiant Threat Intelligence, 2026
- [8] Intellexa 'Aladdin' advertising-based spyware delivery research — Amnesty International Security Lab, 2025-12
- [9] Candiru Entity List announcement — U.S. Department of Commerce, Bureau of Industry and Security, 2021-11-03
- [10] CVE entries for Candiru-associated vulnerabilities — NIST National Vulnerability Database, 2021-2022
- [11] ESET research on Candiru / DevilsTongue activity — ESET, 2021-2022
