Glossary: AdFection, Candiru, DevilsTongue & AdTech Surveillance Terminology

The name Citizen Lab gave to a zero-click mercenary-spyware delivery technique using targeted advertising infrastructure, first publicly documented in October 2026.

Advertising Intelligence — the use of advertising-ecosystem data and infrastructure for intelligence and surveillance purposes, including target discovery, deanonymization, and tracking.

An Israel-based mercenary spyware vendor (private-sector offensive actor) that sells surveillance capabilities to government customers. Also known as Saito Tech and, per 2025 reporting, Integrity Labs.

The name Microsoft assigned to Candiru's sophisticated modular Windows spyware implant.

A corporate identity associated with Candiru, identified by Recorded Future in 2025 and discussed in Citizen Lab's 2026 AdFection report. Acquisition status involving Integrity Partners is not fully resolved in public sources.

Microsoft's threat-actor designation for the operator of DevilsTongue — the company publicly known as Candiru.

The targeting and control platform associated with Discover-Tech, supporting targeting by mobile advertising ID, cookie identifier, and IP address.

The advertising-technology company identified in the 2026 AdFection investigation as operating infrastructure in the targeted-ad delivery path.

A demand-side platform component in Discover-Tech's ad-buying path.

A component associated with selective advertising code delivery, integrated with Controlium.

An endpoint that evaluates request metadata and identifiers to decide target eligibility before returning additional code.

Infrastructure that profiles and confirms target eligibility before an exploit stage is attempted. Candiru operated a large validator infrastructure footprint.

Command and control — infrastructure that implants communicate with to receive tasking and exfiltrate collected data.

A software vulnerability that is publicly unknown or for which no patch exists at the time of exploitation.

An attack that requires no user interaction; the exploit triggers through normal background activity such as ad rendering or message receipt.

Spyware delivery that requires the target to interact (e.g., click a link), as distinct from zero-click delivery.

Commercial spyware developed by private-sector vendors and sold to government customers for surveillance operations.

Spyware produced and sold commercially by private companies, as opposed to state-developed offensive tooling.

Private-Sector Offensive Actor — a company that develops and sells offensive cyber capabilities, typically to governments.

Real-Time Bidding — the millisecond auction process by which programmatic ad inventory is bought and sold.

Demand-Side Platform — software used by advertisers to buy ad inventory programmatically across exchanges.

Supply-Side Platform — software used by publishers to sell ad inventory programmatically.

A marketplace where ad inventory is auctioned in real time between buyers and sellers.

A per-device identifier (IDFA on iOS, GAID on Android) used by the advertising ecosystem for tracking and attribution.

Identifier for Advertisers — Apple's per-device advertising identifier.

Google Advertising ID — Android's per-device advertising identifier.

The process of synchronizing identifiers across different advertising platforms to link a single user across systems.

Identifying a device from a combination of attributes rather than a single identifier.

Identifying a browser from attributes such as user-agent, fonts, and screen characteristics.

The automated buying and selling of ad inventory through real-time auctions and platforms.

The delivery of malicious payloads through advertising infrastructure, traditionally less targeted than AdFection-style delivery.

A sequence of vulnerabilities and techniques combined to achieve code execution or privilege escalation.

A technique to break out of a restricted execution environment.

A technique to gain higher privileges on a system than initially afforded.

Bring Your Own Vulnerable Driver — abusing a legitimately signed but vulnerable driver to gain kernel access.

Abusing COM registry entries so that an attacker's code is loaded by trusted processes; DevilsTongue's documented persistence mechanism.

Indicator of Compromise — a defensive artifact (hash, domain, IP, behavior) used to detect threats.

Tactics, Techniques, and Procedures — the behavioral patterns of a threat actor, as distinct from specific indicators.

An internet-wide scanning platform used by researchers to identify and track infrastructure.

Evidence-based knowledge about threats used to inform defensive decisions.