--- title: Zero-Click Spyware Delivered via Targeted Ads: AdFection description: A technical investigation reveals a zero-click mercenary spyware delivery technique dubbed 'AdFection,' in which targeted online advertisements are weaponized... canonical: https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zero-Click Spyware Delivered via Targeted Ads: AdFection | daily.dev og:description: A technical investigation reveals a zero-click mercenary spyware delivery technique dubbed 'AdFection,' in which targeted online advertisements are weaponized... og:url: https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair og:image: https://api.daily.dev/og/posts/tUJAqpaIR.png og:image:alt: Zero-Click Spyware Delivered via Targeted Ads: AdFection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zero-Click Spyware Delivered via Targeted Ads: AdFection **[Hacker News](https://daily.dev/sources/hn)** · 117 min read · 0 upvotes · 0 comments ## Summary A technical investigation reveals a zero-click mercenary spyware delivery technique dubbed 'AdFection,' in which targeted online advertisements are weaponized to fingerprint, de-anonymize, and infect devices the moment an ad renders. The Israeli company Discover-Tech is exposed as a facilitator operating a platform called Controlium that lets spyware customers select targets by advertising ID, cookie ID, or IP address. At least 45 devices at Al Jazeera were infected with spyware from Candiru (rebranded Integrity Labs) via this pipeline. The investigation also links Discover-Tech to mercenary hacking firm Bindecy, ADINT vendor Intelos, and a separate mass-deanonymization threat actor dubbed DARK CARTOGRAPHER that exploits mobile carrier vulnerabilities to link ad IDs to phone numbers. Analysis of nearly four billion ad bidding records shows Discover-Tech's ads ran on almost 200,000 apps and websites across dozens of countries, served through major networks including Google, Yandex, and Beeswax, and the company had been listed as a 'certified' vendor by Google and IAB Europe until being removed following disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is AdFection and how does it deliver spyware through online ads? AdFection is a zero-click attack technique in which a targeted advertisement itself triggers spyware infection without any user interaction. When an ad renders, it requests JavaScript from a server embedded in the ad; if the device matches a target profile, malicious code is returned and executed, leading to exploitation. Discover-Tech's Controlium platform and NOAS servers implement this handoff, and it was used to infect Al Jazeera devices with Candiru spyware. _Security teams tracking emerging ad-based attack vectors follow deep technical breakdowns like this on daily.dev._ ### How was Al Jazeera infected with Candiru spyware? At least 45 devices within Al Jazeera were infected between 2024 and 2025 through a chain starting with a Discover-Tech ad impression, followed by contact with a Candiru validator server, and ending in communication with a Candiru command-and-control server. Attribution relies on a Windows DLL sample (SHA256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) matching a COM-hijack persistence technique and 48-byte XOR obfuscation seen in Candiru's 2021 attack chain. _Incident responders piecing together spyware infection chains rely on findings like this via daily.dev._ ### What vulnerability allowed unauthorized access to Discover-Tech's Controlium spyware targeting platform? Controlium's backend ignored the digitally-signed Auth0 JWT token and instead trusted an unauthenticated, encrypted user object containing only name and email as its authorization token, making it feasible for an attacker to spoof valid access. Additionally, an unauthenticated '/csv-download' endpoint exposed 128 days of login logs revealing 120 distinct usernames without requiring any password or token. _Developers auditing Auth0 integrations for authorization flaws can track similar findings on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 38 comments across hackernews (as of 2026-10-16). **TL;DR:** The discussion is dominated by outrage over ad networks and ad tech enabling spyware delivery, with heavy debate over who should bear legal liability (ad providers, websites, or regulators) and skepticism about the technical details of how ads translate into device compromise. **Sentiment:** 5% positive · 25% mixed · 70% skeptical **The pushback** - Many argue ad providers and ad networks should face criminal/civil liability for delivering malware, not just fines. - Some see this as part of a larger pattern of unchecked data harvesting and targeted advertising that should be banned outright. - Several commenters are skeptical of the technical chain described, questioning how mobile ad targeting leads to a DLL hijack or zero-click exploit. - Some tie the story to broader geopolitical speculation about mergers and political timing, though this is treated skeptically by others as unsubstantiated. **By community** - hackernews (heated): Strong anger at the ad industry and calls for legal accountability clash with pushback on the practicality of such remedies and doubts about the technical plausibility of the exploit chain. **Hottest debate:** Whether liability for malicious ads should fall on ad providers, websites that host them, or be addressed through broader legislation against targeted advertising. **Open questions** - How exactly does a mobile ad lead to a DLL being executed on a victim's device? - What specific browser/OS vulnerabilities (beyond vague CVE mentions) are being exploited in this chain? **Highlights** > Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal. How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold. And add jail time to fines. Fines means nothing for the rich. > — [Frieren on hackernews · 8 comments](https://news.ycombinator.com/item?id=50105140) > Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious. Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected. Your logic just doesn't compute > — [dylan604 on hackernews · 1 comments](https://news.ycombinator.com/item?id=50107493) > This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine. > — [woodruffw on hackernews](https://news.ycombinator.com/item?id=50106488) > Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware https://radware.com/ https://www.innovid.com/about-us/news/mediaocean-completes-a... > — [the\_giraffe on hackernews · 1 comments](https://news.ycombinator.com/item?id=50105521) > Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself. I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy. > — [kotaKat on hackernews · 1 comments](https://news.ycombinator.com/item?id=50104516) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50101813) · 203 points · 38 comments ## Similar posts on daily.dev - [Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery](https://daily.dev/posts/intellexa-leaks-reveal-zero-days-and-ads-based-vector-for-predator-spyware-delivery-arp9flquy) · The Hacker News · 0 upvotes · 0 comments - [Targeted advertising is also targeting malware](https://daily.dev/posts/targeted-advertising-is-also-targeting-malware-gegtugxsv) · CSO Online · 0 upvotes · 0 comments - [Who’s Tracking You? Use This New Service to Find Out – Krebs on Security](https://daily.dev/posts/who-s-tracking-you-use-this-new-service-to-find-out-krebs-on-security-imfod82bm) · Krebs on Security · 0 upvotes · 0 comments - [Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem](https://daily.dev/posts/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem-rseragq9f) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zero-Click Spyware Delivered via Targeted Ads: AdFection","url":"https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair"},"datePublished":"2026-10-15T15:08:30.691Z","dateModified":"2026-10-16T17:51:08.891Z","description":"A technical investigation reveals a zero-click mercenary spyware delivery technique dubbed 'AdFection,' in which targeted online advertisements are weaponized...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9e00101e27b480c77b4b112f5120441?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9e00101e27b480c77b4b112f5120441?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT117M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Zero-Click Spyware Delivered via Targeted Ads: AdFection"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zero-click-spyware-delivered-via-targeted-ads-adfection-tujaqpair#faq","mainEntity":[{"@type":"Question","name":"What is AdFection and how does it deliver spyware through online ads?","acceptedAnswer":{"@type":"Answer","text":"AdFection is a zero-click attack technique in which a targeted advertisement itself triggers spyware infection without any user interaction. When an ad renders, it requests JavaScript from a server embedded in the ad; if the device matches a target profile, malicious code is returned and executed, leading to exploitation. Discover-Tech's Controlium platform and NOAS servers implement this handoff, and it was used to infect Al Jazeera devices with Candiru spyware. Security teams tracking emerging ad-based attack vectors follow deep technical breakdowns like this on daily.dev."}},{"@type":"Question","name":"How was Al Jazeera infected with Candiru spyware?","acceptedAnswer":{"@type":"Answer","text":"At least 45 devices within Al Jazeera were infected between 2024 and 2025 through a chain starting with a Discover-Tech ad impression, followed by contact with a Candiru validator server, and ending in communication with a Candiru command-and-control server. Attribution relies on a Windows DLL sample (SHA256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) matching a COM-hijack persistence technique and 48-byte XOR obfuscation seen in Candiru's 2021 attack chain. Incident responders piecing together spyware infection chains rely on findings like this via daily.dev."}},{"@type":"Question","name":"What vulnerability allowed unauthorized access to Discover-Tech's Controlium spyware targeting platform?","acceptedAnswer":{"@type":"Answer","text":"Controlium's backend ignored the digitally-signed Auth0 JWT token and instead trusted an unauthenticated, encrypted user object containing only name and email as its authorization token, making it feasible for an attacker to spoof valid access. Additionally, an unauthenticated '/csv-download' endpoint exposed 128 days of login logs revealing 120 distinct usernames without requiring any password or token. Developers auditing Auth0 integrations for authorization flaws can track similar findings on daily.dev."}}]} ```