Executive Summary
A sophisticated attack vector known as 'AdFection' is being used by mercenary spyware vendors, primarily Candiru (now Integrity Labs), to deliver surveillance tools through routine digital advertising. By leveraging the real-time bidding (RTB) process, actors exploit an Israeli ad-tech company, Discover-Tech, to identify high-value targets and deliver malware without requiring any user interaction or link clicks. This campaign has successfully compromised devices belonging to personnel at Al-Jazeera and has impacted a wide range of government and critical infrastructure sectors.
The attack chain involves winning ad auctions to serve malicious tags that profile devices using IP addresses, cookies, and mobile advertising IDs. If a target matches specific criteria, the Discover-Tech infrastructure delivers JavaScript that facilitates the installation of spyware. A related threat actor, Dark Cartographer, has also been observed using this infrastructure to exploit mobile carrier systems to de-anonymize users by linking advertising IDs to phone numbers.
This highlights a systemic vulnerability in the global advertising ecosystem. While major providers like Google have taken steps to block associated domains, the risk remains high for organizations whose personnel are targeted. Security teams are advised to deploy network-level ad blocking and disable mobile advertising IDs on sensitive devices to mitigate this threat.