Exposing AdFection Executive Summary

Each time you see a targeted advertisement on a website or in an app, it is usually the result of a winning bid in a split-second digital auction. These auctions, hosted by companies like Google, are designed to help advertisers reach and profile specific consumers. Real-Time Bidding (RTB) auctions process hundreds of billions of bids and ad sales each day. The system broadcasts a vast amount of information about people and their devices that can be used to infer their interests, browsing behaviour, movements, and habits.

This report shows that this ecosystem is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware. We call this type of attack “AdFection.” At the heart of our report is Discover-Tech, an Israel-based mercenary spyware enabler that functions as a link between the exploitable worlds of digital advertising and states undertaking targeted espionage.

This report is the first-ever technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements. We find with high confidence that devices at international media network Al Jazeera were targeted and infected with Candiru’s mercenary spyware using AdFection.

This report is co-timed with an investigation by Confiant.

Discover-Tech: A Bridge Between Mercenary Spyware and Online Advertising

Discover-Tech presents itself as a legitimate online advertising business. In fact, the Israel-based company provides a bridge between multiple mercenary spyware companies engaged in hacking and the “legitimate” online advertising ecosystem. Our report found no evidence that Discover-Tech was engaged in legitimate advertising activity.  

Discover-Tech’s CEO is Dekel Boni, who has a background in digital advertising. For almost six years, Discover-Tech was associated with principals well known in the mercenary spyware industry. That includes Eric Banoun, who joined the company’s board of directors in 2020 and remained there until 2025. Banoun previously co-founded the surveillance firms Circles and Senpai Technologies, which were closely affiliated with notorious spyware vendors NSO Group and Intellexa. Between 2020 and 2026, Discover-Tech’s shareholders included a company linked to Sara Hamou, who managed the corporate network of Intellexa and was sentenced to eight years in prison (pending appeal) by a Greek court for her role in a spyware abuse scandal in Greece.

Controlium: Zero-Click Targeted Advertising

Discover-Tech operates Controlium, a one-stop platform for mercenary spyware firms to infect targets via online ads. Controlium enables these firms to mass-profile and deanonymize millions of users, and then covertly hack individual targets by sending them seemingly-benign ads containing zero-click exploits to install spyware on their devices.  

Controlium’s users include mercenary spyware firm Candiru (reportedly now owned by US-based Integrity Labs). Candiru was Entity Listed by the United States Commerce Department for developing spyware used to target “government officials, journalists, businesspeople, activists, academics, and embassy workers.” Controlium’s platform is also linked to Israel-based Bindecy, which specializes in zero-click mobile exploits, and another mercenary surveillance firm called Intelos.

Profiling and Hacking Ad Recipients

When a user is shown a seemingly-benign targeted ad placed by Discover-Tech, the user’s ad identifier and IP address are transmitted to servers operated by Discover-Tech. If the user is selected for hacking, the device is ultimately sent malicious JavaScript code, which is executed by the browser or app. The code then exploits and infects the device.

The fact that the seemingly-benign advertisements do not themselves contain the exploit code helps Discover-Tech conceal the hidden purpose of the ads from the platforms that deliver them.

We have found billions of instances of Discover-Tech bidding to send such advertisements to users, and no sign that the company is engaged in any “legitimate” advertising business activities.

Mass Profiling and Deanonymizing

Discover-Tech interfaces with major global advertising networks including Google, Yandex, and Beeswax, and uses a range of techniques to link a single person across various identifiers and networks, such as IP address and mobile advertising ID. 

We analyzed billions of ad bidding records from Discover-Tech and determined the company’s advertisements directed millions of devices across dozens of countries to contact their profiling and infection servers.

We observed Discover-Tech ads displayed in apps ranging from DuoLingo to dating apps, period trackers, German weather apps, Yahoo Mail, Viber, and calling apps such as Truecaller. 

Discover-Tech appears to favour ads in mobile apps, but we observed a wide range of targeting across websites ranging from popular sites in specific geographies ranging from Armenia and Serbia, to Denmark. We also observed their ads displaying on sites including CBC, AccuWeather, FoxNews, the New York Times, Haaretz, and the BBC, among many others.

Ad Impression Data Highlights Systemic AdFection Risk

Our review of the ad bidding data indicates that Discover-Tech ads were shown on devices in national-security-sensitive networks around the world. These include the networks of various ministries of defense, armed forces, national cyber agencies, intergovernmental organizations and multilateral security organizations including NATO, and networks associated with critical infrastructure. The data also show impressions from the networks of media organizations around the world. At minimum, we assess that these ad impressions would have resulted in profiling by Discover-Tech. In some cases, the impressions could have resulted in code from Candiru or other entities running on the user’s device. 

A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware. However, the fact that Discover-Tech was able to bid on and show ads on these networks highlights the systemic risk posed by AdFection and the advertising ecosystem, and warrants urgent investigation to determine whether any users on these networks were infected with spyware. We also note that our visibility into Discover-Tech’s impressions is confined to the data on Discover-Tech’s MyDSP platform. This data does not include data from Beeswax and Eskimi, and covers a limited time period. This incompleteness further reinforces the need for follow-up investigation.

NATO and the United Nations

We identified impressions in NATO and United Nations networks. 

European Union Entities

In Europe, we identified impressions from the networks of the European Parliament, the European Commission, and the Council of the European Union’s General Secretariat. 

Nordic Government & Critical infrastructure Clusters

We identified widespread impressions in Nordic states, including Denmark, Norway and Sweden. We assess that this cluster warrants close scrutiny, and note some of the more concerning findings:

• In Norway, Discover-Tech ads were shown to users on the networks of the legislature (Stortinget), the Norwegian Digital Agency (Digitaliseringsdirektoratet), the Norwegian Communications Authority (Nasjonal kommunikasjonsmyndighet), state IT networks (Statens IT), the Norwegian Police (Politiets It-enhet) and serious crime units (Kripos), among many others. Notably, we also identified impressions in multiple county and municipal networks across northern Norway, including near key military installations (e.g. Alta, Harstad, Nordland).
  
• In Sweden, Discover-Tech ads were shown to users on the networks of the Armed Forces, the national grid operator (Svenska Kraftnat), the state owned power company (Vattenfall AB), the national internet exchange (Netnod AB), defense contractor Saab, Volvo Group, university networks including the Chalmers University of Technology, national research funding bodies (Verket for Innovationssystem), and Sweden’s national Meteorological and Hydrological Institute (Sveriges Meteorologiska och Hydrologiska Institut).
• In Denmark, Discover-Tech ads were shown to users at the national rail network (Banedanmark), the national post (Post Danmark), Denmark’s National Research and Education Network (Forskningsnettet), alongside multiple municipal and regional government networks and public health authorities. They were also shown on networks at Denmark’s digital infrastructure company KMD A/S, renewable energy sector firms such as Vestas Wind Systems and Ørsted, Grundfos, banks including Den Danske Bank, and Copenhagen Airports.

Australia: Critical Infrastructure, Government & University Networks

The ad impression data also reveal a substantial cluster of impressions in Australia, including on government and private-sector networks associated with critical infrastructure sectors like grid and power companies, as well as networks associated with universities and research centres, including entities working on nuclear research, like the Australian Synchrotron, and the Australian Nuclear Science and Technology Organisation.

Governmental Targets: A Global List

Numerous other geographically distinct clusters of widespread impressions appear among the data. Many of these impressions occurred in defense, foreign affairs, internal affairs, or security bodies. The table below provides examples of the government networks where we found Discover-Tech impressions.

Government	Examples of networks with Discover-Tech impressions
Armenia	Central Electoral Commision  Central Bank  Office Of The Prime Minister
Czechia	Ministry of Finance Ministry of Foreign Affairs Ministry of the Interior State Institute for Drug Control Czech Telecommunication Office Ministry of Agriculture  The Czech National Bank Ministry of Labour and Social Affairs Municipal Office, Prague National Cyber and Information Security Agency
Israel	Ministry of Health Ministry of Foreign Affairs Government ICT Authority  Ministry Of Defence Israeli Police Bank of Israel Israel Internet Association Israel Airports Authority
Italy	Bank of Italy Parliament (Camera dei deputati) Ministry of Defense

Our investigation is ongoing. As of now, we have identified impressions in government-operated networks in the following countries:

• Armenia
• Australia
• Azerbaijan
• Bhutan
• Brazil
• Czechia
• Denmark 
• Indonesia
• Israel
• Italy 
• Kosovo
• Libya
• Malaysia
• Mexico
• Montenegro
• Norway
• Pakistan
• Russia
• Somalia
• Sweden
• Thailand
• The United Arab Emirates
• The United States (American Samoa)
• Uruguay

We also found impressions on the networks of election oversight bodies in Armenia, Indonesia, and Mexico.

Chips & Semiconductors: from research to fabrication

We found what appears to be a nexus among the advanced semiconductor industry, covering the chain from design, memory, to chip development and fabrication, with the greatest number of impressions seen in Intel networks, alongside Nvidia, Sandisk, Texas Instruments, Broadcom, Micron Technology, and ARM. We also identify numerous research entities in this category like IMEC. We also identified impressions within the networks of large U.S. tech firms including Apple, Microsoft, and Motorola.

We also identified impressions in specifically defense-sector tech entities, including Raytheon (U.S.) and Elbit Systems LTD (Israel), and the nuclear sector, including the Westinghouse Electric Company (U.S.).

Global Media Organizations

Given our identification of zero-click attacks against Al Jazeera, we scrutinized bidding records for impressions within the networks of media organizations. We found many. Often, these included the largest media organizations in a particular country, as well as public broadcasters and media conglomerates. The countries (with a count of institutions) include:

• Australia: 3
• Denmark: 3  
• France: 1  
• Mexico: 2  
• Israel: 3  
• Italy: 2
• Norway: 2 
• Sweden: 3  

We also identified impressions within the networks of international media services. Our investigations into these cases are ongoing.

The Digital Advertising Supply Chain: Dangerously Compromised 

Our analysis reveals a dangerous lack of due diligence in the advertising ecosystem that Discover-Tech actively exploited. Despite supporting mass-profiling and mercenary spyware hacking, Discover-Tech has nonetheless appeared on several lists of “certified” and “approved” advertising vendors maintained by Google and IAB Europe, the advertising industry association.

The fact that a “certified” company could target millions of users for years with no signs of legitimate activity highlights the dangerously inadequate controls over a sector that by its very nature touches almost every individual with a mobile device or a web browser in extremely invasive ways.

As a result of this investigation, Google and IAB Europe have removed Discover-Tech from their ad vendor lists. Google and Beeswax have terminated the company’s access to their ad systems.

The AdFection attacks and espionage described in this report impact millions of people in dozens of countries. Existing laws and self-regulation by the industry failed to catch or prevent them. Our report provides guidance to regulators, defenders and the advertising industry on how to stop AdFection and ADINT-style espionage.