Full Report
Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google's seal of approval
Analysis Summary
# Tool/Technique: AdFection (Discover-Tech / Controlium)
## Overview
**AdFection** is a delivery technique that weaponizes the global Real-Time Bidding (RTB) advertising ecosystem to deliver "zero-click" mercenary spyware. By masquerading as a legitimate adtech firm, the provider (Discover-Tech) identifies specific high-value targets through bid stream data and serves malicious advertisements that trigger exploits without requiring the user to interact with the ad.
## Technical Details
- **Type:** Attack Framework / Delivery Technique
- **Platform:** Android, iOS, and Web Browsers
- **Capabilities:** Targeted device profiling, reconnaissance, and delivery of zero-click exploits.
- **First Seen:** Activity traced back to 2020; specific campaigns identified in 2024–2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing] (Specifically Malvertising)
- [T1203 - Exploitation for Client Execution]
- **[TA0007 - Discovery]**
- [T1612 - User Insight through Ad Networks] (Non-standard technique: RTB Exploitation)
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **RTB Exploitation:** Leverages the Real-Time Bidding process to receive telemetry (location, device type, OS version, IP address) on users whenever an ad slot is auctioned.
- **Micro-Targeting:** Uses the gathered telemetry to filter for specific individuals or organizations (e.g., Al Jazeera, government agencies, NATO).
- **Zero-Click Delivery:** Serves malicious payloads via "approved" ad networks that exploit browser or OS vulnerabilities upon the ad being rendered, requiring no user interaction.
### Advanced Features
- **Supply Chain Infiltration:** Obtained status as a "Google Approved Vendor" and IAB Europe member to bypass security filters and gain access to billions of ad-bidding records.
- **Covert Traffic Redirection:** Secretly directs millions of devices toward infrastructure associated with spyware vendors (e.g., Candiru) to facilitate further exploitation or fingerprinting.
## Indicators of Compromise
- **File Hashes:** *Note: Specific hashes for the 2026 payloads were not detailed in the article text; typically associated with Candiru/Integrity Labs binaries.*
- **File Names:** N/A (Memory-resident or browser-cache based delivery).
- **Network Indicators:**
- `discover-tech[.]io` (Defanged)
- `controlium[.]io` (Defanged)
- Servers associated with **Candiru / Integrity Labs**.
- **Behavioral Indicators:**
- Unsolicited connections to known spyware C2 infrastructure immediately following the loading of a website or app containing ads.
- High frequency of RTB data leakage to Discover-Tech associated domains.
## Associated Threat Actors
- **Discover-Tech:** The Israeli adtech firm facilitating the delivery.
- **Candiru (aka Integrity Labs / Saito Tech):** The mercenary spyware vendor providing the final payload.
## Detection Methods
- **Signature-based detection:** Monitoring for known Candiru/Integrity Labs malware signatures.
- **Behavioral detection:** Identifying anomalous "zero-click" network requests originating from mobile browsers or webview components to known surveillance infrastructure.
- **Traffic Analysis:** Monitoring for unexpected redirection to third-party ad servers not associated with the primary content provider, especially those with no history of legitimate commercial activity.
## Mitigation Strategies
- **Browser Hardening:** Use of content blockers (Ad-blockers) to prevent the rendering of third-party advertising scripts.
- **Network Filtering:** Blocking domains associated with Discover-Tech and known mercenary spyware C2s at the DNS or Firewall level.
- **Platform Updates:** Ensuring mobile OS and browsers are updated to the latest versions to patch the vulnerabilities exploited by the "zero-click" ads.
- **Policy:** Organizations should consider restricting the use of ad-supported apps on sensitive devices.
## Related Tools/Techniques
- **Pegasus (NSO Group):** Another prominent mercenary spyware often delivered via zero-click vectors (though usually via messaging apps).
- **Malvertising:** The broader category of using ads to spread malware.
- **Bidstream Data Harvesting:** The technique of collecting intelligence via the advertising auction process.