ADINT on a global scale

Analytics2026-10-23, 11:52

Researchers from Citizen Lab and Confiant have published investigations into how digital advertising infrastructure was used to distribute Candiru spyware. Analysts believe this is the first technical evidence that targeted advertising has been used to deliver mercenary spyware.

The investigation focuses on the Israeli company Discover-Tech, which operated the MyDSP platform, using it to bid in advertising auctions on Google, Yandex, Vungle, and other platforms. Through the Controlium platform, its clients—including operators of mercenary spyware—could select specific user devices for profiling or infection based on mobile advertising identifiers (on iOS or Android), browser identifiers, and/or victims’ IP addresses.

Researchers dubbed this infection technique AdFection. The pipeline works as follows:

Discover-Tech wins an ad auction, and the ad is displayed on the user’s device.
When the ad loads, it connects to a Discover-Tech server and transmits the user’s advertising identifiers.
If the device is selected as a target, the server returns JavaScript code to be executed; otherwise, it returns an empty response. The ad still collects browser data, including cookies and the public IPv6 address.

The researchers confirmed the practical use of this scheme through the example of the Al Jazeera news network. At least 45 devices on the media network were targeted in attacks using Discover-Tech infrastructure in 2024–2025.

Analysis of network logs showed that the victims’ devices initially connected to Discover-Tech infrastructure domains, which analysts attribute to ad delivery. A validation server then checked the devices before profiling and infecting them. Ultimately, the compromised device connected to Candiru C2 servers.

Al Jazeera also provided a DLL file from one of the compromised Windows devices containing hardcoded C2 server addresses. Citizen Lab attributed the sample to Candiru with high confidence: its persistence mechanisms, string obfuscation, and connection-checking mechanisms match those described in the 2021 report.

The scale of the advertising infrastructure—billions of bids. From March through June 2026, MyDSP participated in auctions for 3.77 billion ad impressions and won approximately 11.7% of them.

At least 718 million bids (approximately 19%) involved ads that showed signs of contacting NOAS servers, a component used to selectively deliver JavaScript code to specific devices. The Yandex advertising system accounted for 67.4% of the bids. One example was an Akedo ad displayed on livelib[.]ru in May 2025.

ID syncing expanded profiling capabilities. Analysts found that Discover-Tech synchronized user identifiers with Comcast’s Beeswax, Yandex, and Microsoft’s Xandr advertising systems.

This makes it possible to match the same user across different advertising platforms and use a known identifier to find and target that user in another system. For example, the Controlium platform allows a Beeswax ID to be specified as the target identifier, potentially enabling data from one advertising system to be used to target a user through another.

Synchronization can occur even when the user does not see an ad: visiting a website where the relevant requests run in the background is sufficient.

The advertising infrastructure had already been used to deanonymize users at scale. Researchers found that the threat actor known as DARK CARTOGRAPHER had been using platforms such as Discover-Tech for this purpose since 2019. One method relies on mobile carrier frictionless authentication: when certain websites are accessed, carriers add a header containing the user’s phone number to unencrypted HTTP requests. Weaknesses in the validation of allowed websites allow attackers to obtain this information through ads.

Ads were displayed on sensitive networks around the world. Researchers note that the bidding data contains evidence of ads being displayed on IP addresses belonging to critical infrastructure organizations, government agencies, and international organizations.

Those mentioned include: • NATO and UN networks; • Russian government networks; • Armenia—the Central Election Commission, Central Bank, and Prime Minister’s Office; • Israel—the Ministry of Health, Ministry of Foreign Affairs, Ministry of Defense, and other agencies; • networks belonging to Intel, Nvidia, Broadcom, and several media companies.

However, the mere fact that an ad was displayed does not confirm an infection or a targeted attack—it primarily demonstrates the scale of Discover-Tech infrastructure’s presence.

As a result, Google, Beeswax, Vungle (Liftoff), Eskimi, and IAB Europe took steps to restrict or terminate Discover-Tech’s access to their advertising infrastructure after engaging with the researchers and receiving the results of their work.

Insufficient oversight of advertising vendors and the technical characteristics of digital advertising infrastructure create conditions for the spread of malvertising and make such threats difficult to counter. To reduce the risks, organizations need to improve mechanisms for detecting and blocking malicious campaigns and strengthen cooperation between researchers and ad-tech providers.

Vendors

Products