AdFection: The Zero-Click Spyware Campaign That Weaponized Online Ads

How AdFection Turned Real-Time Ad Bidding Into a Spyware Delivery Channel

AdFection exploited real-time bidding (RTB), which allows advertisers to bid for opportunities to display ads on websites and in applications. These bid requests can expose user and device information, depending on the platform and implementation. Citizen Lab found that Discover-Tech’s advertising platform, Controlium, used identifiers such as mobile advertising IDs, browser identifiers, and IP addresses to select specific targets.

Many Discover-Tech advertisements included a script tag that connected to a Discover-Tech server when an ad rendered. The request transmitted available identifying information, allowing the server to determine whether the device matched its targeting criteria.

For most impressions, the server returned no executable JavaScript because the user was not selected for spyware targeting. However, the advertisement could still collect and transmit information, including cookies associated with the webpage displaying the ad and the device’s public IPv6 address, to Discover-Tech. For selected targets, the server could return attacker-controlled JavaScript automatically, creating a path for spyware delivery without requiring a click or download.

Researchers did not publicly disclose a complete exploit chain for every affected platform or identify one browser vulnerability responsible for every infection.

What the Al Jazeera Investigation Revealed About Candiru Spyware

Citizen Lab linked Discover-Tech’s advertising infrastructure to spyware developed by Candiru, which the researchers describe as having been rebranded as Integrity Labs. Its investigation covered activity targeting Al Jazeera devices during 2024 and 2025. Researchers reported that at least 45 devices were targeted and linked the campaign to Candiru spyware with high confidence.

Network logs revealed a sequence connecting advertising activity to spyware infrastructure:

• An advertisement rendered. The device contacted Discover-Tech infrastructure, indicating an ad impression.
• A validator checked the device. The device contacted a Candiru validator server for an initial assessment before further profiling.
• The device contacted command-and-control infrastructure. Researchers observed subsequent connections to a Candiru command-and-control server.
• A spyware sample corroborated attribution. Al Jazeera isolated a Windows DLL from one compromised device. Its embedded command-and-control servers matched infrastructure identified by the researchers.

This evidence connects the advertising mechanism to observed spyware activity rather than merely demonstrating a theoretical delivery method.

However, researchers did not establish that every targeted device was successfully compromised. These limitations matter when assessing exposure and determining what evidence an investigation should collect.

Why Government and Enterprise Devices Also Face Exposure

Citizen Lab analyzed approximately four billion Discover-Tech ad-bidding records collected over four months. The records showed advertisements across nearly 200,000 unique websites and Android and iOS applications combined. Researchers also identified advertisements appearing within sensitive government and organizational networks.

The findings included networks associated with NATO and other government or international organizations. Confiant’s separate investigation identified advertisements on networks associated with the U.S. Department of Defense and other institutions. These impressions demonstrate potential exposure, not confirmed compromise of those organizations’ devices.

For enterprises, the key concern is that conventional phishing defenses cannot address this delivery path by themselves. Security awareness training remains valuable, but it cannot stop a user from being targeted simply because an advertisement renders.

Employees may encounter advertisements while reading news, using applications, or browsing otherwise trusted websites. The presence of an advertisement does not necessarily mean the website or application publisher deliberately participated in the attack.

Organizations with high-risk personnel, including executives, journalists, researchers, and government liaisons, should assess exposure according to the people, devices, and information they need to protect.

How Enterprises Can Reduce Exposure to AdFection-Style Attacks

Block advertising and tracking where feasible

Citizen Lab recommends blocking online advertising at organizational gateways and on work-issued devices where possible. It also recommends reducing targeted advertising through advertising-ID controls and using browsers with stronger anti-tracking and ad-blocking features.

Security teams should evaluate network-level ad blocking alongside endpoint browser controls. Hexnode UEM can support selected web-filtering policies and managed browser settings on supported platforms, subject to their enrollment and configuration requirements. These controls may complement a broader ad-blocking strategy, but they should not be presented as a universal solution for blocking malicious advertising.

Maintain supported operating systems and applications

Organizations should keep mobile operating systems, browsers, and applications updated. Security updates can address known vulnerabilities that attackers might exploit after delivering code.

However, patching cannot necessarily stop an exploit for which a vendor has not yet released a fix. Maintaining update compliance reduces exposure to known weaknesses but does not eliminate every zero-click risk.

Restrict unnecessary applications and permissions

Review which applications employees can install and use on managed devices. Apply appropriate installation restrictions, remove unnecessary applications, and review permissions according to business requirements.

These measures can reduce exposure to unnecessary or unapproved applications. However, they do not inherently prevent malicious advertising JavaScript from executing inside an already permitted application.

Establish a targeted incident-response procedure

Develop a response process for suspected spyware activity involving high-risk personnel. Investigations should examine advertising-related network requests, suspicious external connections, unusual endpoint activity, and relevant device logs.

Preserve evidence before resetting or re-enrolling a suspected device. When the risk is significant, seek specialist mobile forensic support. Citizen Lab recommends expert assistance for people facing elevated targeting risks.

Featured resource

Strengthen Your Mobile Threat Defense Strategy

Explore a practical checklist for strengthening mobile security through endpoint protection, application management, network security, threat detection, and user awareness.

Download the whitepaper

Where Hexnode UEM Fits in an AdFection Defense Strategy

Hexnode UEM can support endpoint hardening through documented device-management capabilities. It should not be presented as a dedicated ad-blocking or zero-click spyware detection solution.

Enforce software updates on managed devices

Hexnode UEM documents software-update management for Apple devices, including iOS, iPadOS, and macOS. Administrators can configure software-update preferences and manage supported updates through the console.

For Android devices, Hexnode UEM documents device-owner OS-update policies, including automatic updates and scheduled update behavior. Available controls depend on device enrollment, the operating system, and manufacturer restrictions.

For Windows devices, Hexnode UEM supports automated operating system patch management and third-party application patching for supported applications. Administrators can configure automated deployment rules, use maintenance windows, and manage restart behavior where supported. Patch availability and deployment depend on the update, application coverage, device state, and configured policies.

These capabilities help IT teams manage device software but do not guarantee protection against undisclosed browser or application exploits.

Apply application restrictions

Hexnode UEM supports application blocklisting and allowlisting for Android, supervised iOS, macOS, and supported Windows editions. These policies help administrators restrict unwanted applications or limit access to approved apps.

Additional installation restrictions depend on the operating system, enrollment method, and supported platform controls. These policies can restrict unnecessary or unapproved applications, but they do not inherently prevent malicious advertising JavaScript from executing inside a permitted browser or application.

Maintain consistent device policies

Hexnode UEM allows administrators to associate device policies with managed devices, users, and groups, subject to platform and enrollment limitations. Where supported, web-filtering policies and browser settings can complement these baselines.

Organizations should combine these controls with separately managed advertising protection, network security, and incident-response measures. UEM policies alone do not establish that malicious advertising scripts are blocked.

AdFection Requires Defenses Beyond User Awareness

AdFection reinforces the need to address threats that bypass user interaction. Enterprises should combine advertising controls, supported software updates, application restrictions, and targeted incident response. Hexnode UEM can support this defense through patch management for supported operating systems and applications, application restrictions, and platform-specific browser or web-filtering policies. These device-management controls complement broader advertising security and spyware-detection measures rather than replacing them.