Digital advertising is designed to connect businesses with audiences. But what happens when the same infrastructure used to deliver advertisements becomes a channel for sophisticated surveillance and spyware?
A recent investigation by Citizen Lab has exposed a concerning development in cybersecurity: targeted online advertisements were allegedly used to deliver zero-click spyware associated with Candiru, a commercial surveillance software provider.
The investigation identified Israeli advertising technology company Discover-Tech and its Controlium platform as part of an operation researchers named AdFection. The findings demonstrate how advertising technology, device tracking, and malicious code can combine to create security risks that extend far beyond traditional phishing attacks.
For organizations that depend on digital advertising, mobile applications, cloud platforms, and third party services, this development raises important questions about privacy, supply chain security, and the limits of conventional cybersecurity defenses.
1. How the AdFection Operation Worked
Digital advertising frequently relies on real-time bidding (RTB), an automated process through which advertisers compete to display advertisements to users across websites and applications.
These advertising systems can process information about devices and users, including IP addresses, mobile advertising identifiers, and other signals that help determine which advertisement should be displayed.
According to Citizen Lab’s investigation, Discover-Tech’s Controlium platform used this ecosystem to profile devices, associate identifiers with users, and support targeted spyware delivery.
Researchers reported that scripts associated with advertisements could communicate with Discover-Tech infrastructure and receive further instructions based on information such as IP addresses and advertising identifiers.
This created a potential pathway for delivering malicious code through advertisements displayed in otherwise legitimate digital environments.
The operation is particularly concerning because users may encounter an advertisement while visiting a trusted website or using a familiar mobile application, without realizing that the advertising supply chain has introduced a security risk.
2. Why Zero-Click Spyware Is So Dangerous
Traditional cyberattacks frequently rely on users clicking malicious links, opening infected attachments, downloading files, or entering credentials into fraudulent websites.
A zero-click attack is different.
It can exploit a vulnerability or another execution pathway without requiring the target to interact with a malicious link or attachment.
In the AdFection investigation, researchers described advertisements being used as a delivery mechanism for spyware capable of compromising selected devices without a conventional user initiated action.
This makes the attack model particularly difficult to address through awareness training alone.
Even cautious users who avoid suspicious links may remain exposed if their devices encounter malicious content through an advertising channel.
Depending on the spyware and the vulnerabilities exploited, a successful compromise could expose sensitive information, communications, and other data stored on a targeted device.
The key lesson is that user awareness remains essential, but it cannot replace technical controls designed to prevent and detect sophisticated exploitation.
3. Journalists and Sensitive Organizations Were Among the Targets
Citizen Lab reported that at least 45 devices associated with Al Jazeera were targeted between 2024 and 2025, with the investigation linking the attacks to Candiru spyware.
The researchers also identified a Discover-Tech server containing approximately four billion advertising bid records. Their analysis indicated that the company’s advertisements had appeared across nearly 200,000 unique websites and Android and iOS applications worldwide. These figures describe the reach of the advertising infrastructure, not the number of confirmed spyware infections.
The reported targeting of journalists highlights the potential consequences for people and organizations handling confidential information.
Journalists, government officials, legal professionals, executives, researchers, and human rights organizations may possess sensitive communications or information that makes them attractive surveillance targets.
For businesses, the same underlying risks raise concerns about executive devices, employee smartphones, confidential communications, intellectual property, and access to corporate applications.
Organizations should therefore consider targeted spyware and sophisticated mobile exploitation as part of their broader threat models, especially when protecting high risk individuals or sensitive operations.
4. The Advertising Supply Chain Creates a New Attack Surface
Many organizations carefully evaluate their direct technology vendors while paying less attention to the extended advertising ecosystem.
A digital advertisement may pass through multiple parties, including advertisers, advertising agencies, exchanges, supply-side platforms, demand-side platforms, analytics providers, and publishers.
Each additional integration creates potential dependencies and opportunities for abuse.
The AdFection findings illustrate how a component that appears to serve a legitimate commercial purpose may be misused to support tracking or malicious code delivery.
This is a broader third party security concern.
Organizations should evaluate not only the security of their own websites and applications, but also the external services and scripts that operate within them.
Important questions include:
- Which advertising and analytics providers are authorized?
- What scripts and external resources are loaded by websites and applications?
- What device and user information is shared with third parties?
- Can external scripts execute code in sensitive user sessions?
- How are advertising vendors evaluated and monitored?
- Can suspicious advertising sources be blocked centrally?
- Are third party security incidents included in incident response plans?
Vendor approval should not be treated as a permanent guarantee of security. Organizations need ongoing oversight of external services and their behavior.
5. Why Traditional Security Controls May Not Be Enough
Endpoint protection, firewalls, identity security, and vulnerability management remain important. However, sophisticated zero-click attacks can challenge defenses that rely primarily on detecting suspicious downloads or persuading users not to click malicious links.
Advertising based attacks may exploit vulnerabilities in software or abuse trusted delivery mechanisms. As a result, security teams may need to investigate a wider range of signals.
These can include:
- Unexpected browser or application behavior
- Unusual network connections initiated by mobile devices
- Suspicious scripts loaded from external advertising resources
- Abnormal device activity or unexplained configuration changes
- Attempts to exploit browser or operating system vulnerabilities
- Unexpected communication with known malicious infrastructure
- Unusual access to sensitive enterprise accounts following device compromise
No single indicator proves that spyware is present. Investigations should correlate endpoint, network, application, and identity telemetry before drawing conclusions.
For high risk organizations, threat hunting and specialized mobile security assessments can help identify gaps that conventional security testing may not uncover.
6. Practical Steps Organizations Can Take
The AdFection investigation provides several lessons for organizations seeking to strengthen their defenses.
Review and Restrict Advertising Dependencies
Maintain an inventory of advertising providers, external scripts, and third party integrations used by corporate websites and applications.
Remove unnecessary dependencies and review whether each service requires the access and data it receives.
Apply Gateway-Level Advertising Controls
For high risk environments, consider blocking targeted advertising at network gateways where operationally feasible. Citizen Lab identified this as an important defensive measure while the advertising industry works to address the reported attack pathway.
Security teams should test these controls carefully to avoid disrupting legitimate business applications.
Strengthen Mobile and Endpoint Security
Keep operating systems, browsers, and applications updated. Use supported endpoint and mobile threat defense capabilities where appropriate, and investigate unusual device behavior promptly.
Organizations handling highly sensitive information should consider specialized assessments of mobile device security and exposure to advanced spyware.
Reduce Unnecessary Tracking
Review mobile advertising identifiers, tracking permissions, and data sharing practices.
Where appropriate, users can disable ad personalization or tracking features and reset advertising identifiers if their device supports it. These steps may reduce some forms of tracking, but they do not guarantee protection against zero-click spyware.
Monitor Third Party Resources
Use appropriate browser security policies, script monitoring, and network controls to reduce the risk introduced by external resources.
For web applications, Content Security Policy and other browser security controls can help restrict resource loading, although they are not complete defenses against every advertising based attack.
Prepare for Advanced Spyware Incidents
Develop response procedures for suspected device compromise, including evidence preservation, device isolation, account protection, forensic analysis, and escalation to specialist investigators.
High risk individuals may require dedicated security guidance and additional protections beyond standard employee awareness training.
Strengthen Vendor Governance
Evaluate advertising technology providers and other third parties according to their access to sensitive information, their security practices, and their role in critical business processes.
Contracts, vendor assessments, privacy reviews, and continuous monitoring should work together to manage supply chain risk.
7. Privacy and Compliance Implications
The incident also raises questions about how advertising data is collected, combined, retained, and used.
Device identifiers and browsing information can become sensitive when they are linked to identifiable individuals or used to track their activities.
Organizations should assess their practices against applicable privacy laws and contractual requirements, including:
- GDPR and applicable data protection regulations
- Requirements governing personal information and consent
- Data minimization and purpose limitation principles
- Third party data sharing and vendor oversight
- Appropriate retention and deletion practices
- Incident reporting and breach response obligations
For businesses operating across multiple jurisdictions, compliance requires understanding both the data they collect directly and the information shared through external platforms.
A vendor’s commercial legitimacy or certification does not remove an organization’s responsibility to assess privacy and security risks.
Industries That Should Pay Attention
Financial Services and Banking
Banks, fintech companies, investment firms, and payment providers handle sensitive financial information and high value digital identities. COE Security can help assess mobile applications, web platforms, third party integrations, identity controls, and data protection practices to identify vulnerabilities and improve security monitoring.
Healthcare and Life Sciences
Healthcare providers and research organizations must protect patient information, clinical communications, and sensitive research data. COE Security can support application and mobile security assessments, data governance reviews, vulnerability management, and compliance aligned security improvements.
Retail and E-commerce
Retailers depend heavily on advertising technology, analytics, customer engagement tools, and mobile applications. COE Security can help review third party scripts, assess web and mobile application security, test APIs, and strengthen customer data protection.
Government and Public Sector
Government agencies and public service providers may handle confidential communications and sensitive citizen information. COE Security can support mobile and network security assessments, threat monitoring, vendor risk reviews, and incident response readiness.
Manufacturing and Industrial Organizations
Manufacturers increasingly depend on mobile devices, cloud applications, supplier portals, and connected digital infrastructure. COE Security can help assess application security, network controls, third party dependencies, and infrastructure protection.
Media, Journalism, and Communications
Media organizations and journalists may be high value targets for surveillance because of their sources, communications, and confidential reporting. COE Security can help evaluate mobile and endpoint security, conduct security assessments, strengthen identity controls, and improve incident response procedures.
Technology and SaaS Companies
Technology providers often integrate advertising platforms, analytics services, third party scripts, and external APIs into their products. COE Security can help assess software supply chain risks, secure applications and APIs, review cloud environments, and strengthen secure development practices.
Conclusion
The AdFection investigation demonstrates how the digital advertising ecosystem can become a channel for sophisticated surveillance and spyware delivery.
When malicious code can be distributed through advertisements, cybersecurity risks extend beyond suspicious emails, fraudulent websites, and infected downloads. Trusted websites and applications may also expose users to threats introduced through third party infrastructure.
Organizations must therefore look beyond their internal networks and assess the security of the broader digital ecosystem they depend on.
Stronger vendor oversight, advertising controls, mobile security, vulnerability management, privacy governance, continuous monitoring, and tested incident response can help reduce exposure and improve resilience.
The most important lesson is that trust in a platform should never replace security validation. In an increasingly connected digital environment, every external dependency must be evaluated according to the access it receives, the data it processes, and the risks it can introduce.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
In addition, COE Security helps organizations address third party and digital supply chain risks through mobile and web application security assessments, third party risk reviews, vulnerability management, cloud security assessments, secure development practices, API security testing, continuous monitoring, and penetration testing.
For financial services and banking, we help assess digital banking platforms, mobile applications, identity controls, APIs, and data protection measures while supporting relevant security and compliance requirements.
For healthcare and life sciences, we help protect sensitive patient and research information through mobile and application security testing, cloud assessments, data governance reviews, and compliance aligned security controls.
For retail and e-commerce, we help assess customer facing applications, advertising integrations, external scripts, payment environments, APIs, and digital supply chains to identify weaknesses that could expose customer information.
For government and public sector organizations, we support security assessments, mobile and network security reviews, third party risk management, threat monitoring, and incident response readiness.
For manufacturing and industrial organizations, we help evaluate applications, cloud environments, connected infrastructure, supplier related risks, and security controls that protect sensitive business information.
For media, journalism, and communications organizations, we help strengthen endpoint and mobile security, review identity controls, assess web applications, and improve preparedness for targeted cyber threats.
For technology and SaaS companies, we help identify vulnerabilities across mobile applications, web platforms, APIs, cloud environments, software dependencies, and third party integrations through security testing, secure development consulting, and risk assessments.
Our goal is to help organizations identify security gaps, reduce cyber risk, protect sensitive information, strengthen resilience, and maintain compliance across increasingly connected digital environments.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption, emerging spyware threats, mobile security, digital supply chain risks, and practical cybersecurity strategies to stay updated and cyber safe.
Click to read our LinkedIn feature article