Discover-Tech Weaponized Online Ad Auctions for Spyware

A four-month investigation by The Citizen Lab revealed that advertising vendor Discover-Tech used its Controlium platform to turn real-time ad bidding into a distribution pipeline for zero-click mercenary spyware. Dubbed AdFection, the operation allowed attackers—including Israeli spyware firm Candiru—to profile millions of users and deliver malicious code to specific targets simply when an ad rendered in an app or browser. Over the study period, Discover-Tech's ads appeared across 120,768 websites and 75,373 Android and iOS applications, serving impressions on networks belonging to NATO, Apple, Microsoft, and Intel, and ultimately infecting Windows systems at news agency Al Jazeera.

The attack exploited online ad exchanges that run hundreds of billions of real-time auctions daily. Discover-Tech maintained status as an approved vendor with Google and IAB Europe, distributing ads through major supply platforms including Yandex, Beeswax, Vungle, and Eskimi. When a target device triggered a bid request, the winning ad rendered benign creative content to pass security scanners. However, the background code transmitted the device's IP address and mobile advertising identifier back to command servers, which responded with malicious payloads only when identifying pre-selected targets. Google and other partner networks disconnected Discover-Tech after receiving disclosure from researchers.

For enterprise security teams, the campaign underscores how corporate devices expose persistent identity data to untrusted ad bidding environments. Security analysts emphasize that blocking mobile advertising identifiers through mobile device management systems eliminates a primary targeting mechanism. Organizations should also enforce domain-level ad blocking at the DNS or secure web gateway layer to cover in-app traffic, enforce strict browser patch schedules, and activate Apple Lockdown Mode for elevated-risk personnel traveling to sensitive regions.