Executive Summary
A groundbreaking investigation by The Citizen Lab has confirmed the first known use of targeted online advertisements to deliver zero-click mercenary spyware, a technique dubbed 'AdFection'. The Israeli company Discover-Tech acted as a primary facilitator, using its Controlium platform to bridge the gap between the legitimate digital advertising ecosystem and mercenary spyware vendors like Candiru (rebranded as Integrity Labs). This attack chain was used to compromise devices at Al Jazeera, as well as target government ministries and critical infrastructure globally.
The technical architecture relies on 'Controlled Ads' containing script tags pointing to NOAS (Next-Generation Offensive Ad Serving) servers. When an ad renders, the device submits unique identifiers (MAIDs or cookie IDs) to the NOAS server, which responds with malicious JavaScript or browser exploits for specific high-value targets while serving blank responses to others to evade detection. Furthermore, a separate actor known as DARK CARTOGRAPHER has been observed using this infrastructure to mass-deanonymize mobile users by linking advertising IDs to phone numbers through mobile carrier vulnerabilities.
This discovery highlights a systemic failure in digital advertising oversight, as Discover-Tech maintained 'certified' status with Google and IAB Europe for years despite deep ties to the offensive cyber industry. The ability of threat actors to exploit real-time bidding (RTB) auctions to profile and infect users on sensitive networks poses a critical risk to national security, journalism, and civil society.