Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli ad firm Discover-Tech used for Candiru spyware zero-click attacks against Al Jazeera.
Run Candiru?
Get an email when a reviewed story names Candiru, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
An Israeli advertising company, Discover-Tech, has been identified as a key enabler for Candiru's spyware, facilitating zero-click attacks through targeted advertisements. The operation, dubbed AdFection, allowed threat actors to de-anonymize, fingerprint, and infect millions of devices, including those at Al Jazeera. Discover-Tech's Controlium platform leverages Real-Time Bidding auctions to deliver malicious ads, which can execute scripts to profile and compromise users.
The lesson from this incident
Full lessonDiscover-Tech, an Israeli advertising firm, secretly operated as a delivery mechanism for Candiru's commercial spyware by weaponizing the Real-Time Bidding (RTB) ecosystem — a trusted advertising infrastructure used by millions of websites. Because RTB auctions execute code silently and at massive scale, threat actors were able to de-anonymize, fingerprint, and infect devices without any user interaction, making traditional awareness-based defenses irrelevant. This highlights the inherent danger of trusting third-party ad supply chains, where a single compromised or complicit intermediary can compromise millions of endpoints globally. Organizations and individuals have no direct visibility into the ad code executing in their browsers, creating a silent attack surface that is extraordinarily difficult to detect or remediate.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.