Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli ad firm Discover-Tech used for Candiru spyware zero-click attacks against Al Jazeera.
An Israeli advertising company, Discover-Tech, has been identified as a key enabler for Candiru's spyware, facilitating zero-click attacks through targeted advertisements. The operation, dubbed AdFection, allowed threat actors to de-anonymize, fingerprint, and infect millions of devices, including those at Al Jazeera. Discover-Tech's Controlium platform leverages Real-Time Bidding auctions to deliver malicious ads, which can execute scripts to profile and compromise users.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Candiru?
Get an email when a new story names Candiru, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDiscover-Tech, an Israeli advertising firm, secretly operated as a delivery mechanism for Candiru's commercial spyware by weaponizing the Real-Time Bidding (RTB) ecosystem — a trusted advertising infrastructure used by millions of websites. Because RTB auctions execute code silently and at massive scale, threat actors were able to de-anonymize, fingerprint, and infect devices without any user interaction, making traditional awareness-based defenses irrelevant. This highlights the inherent danger of trusting third-party ad supply chains, where a single compromised or complicit intermediary can compromise millions of endpoints globally. Organizations and individuals have no direct visibility into the ad code executing in their browsers, creating a silent attack surface that is extraordinarily difficult to detect or remediate.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.