What happened
Citizen Lab published research describing an operation it calls AdFection. Ads purchased by an Israeli company called Discover-Tech were used to de-anonymize users, fingerprint their devices, and in some cases infect them. Between 2024 and 2025, at least 45 devices inside Al Jazeera were targeted this way and ended up carrying spyware from Candiru, an Israel based mercenary vendor.
The mechanism sits inside ordinary advertising. Companies bid in real time auctions for the chance to show an ad, and ad exchanges hold a great deal of device and user data to make that targeting work. Ad code also runs inside apps and browsers. Many Discover-Tech ads carried a script that connected back to its infrastructure, submitted the device advertising ID, and executed JavaScript chosen from a combination of IP address and identifiers. That is enough to recognise a device, and then to exploit it without a click.
Discover-Tech presented as a legitimate advertising business, and Citizen Lab assesses it as likely a front that bridged ad vendors and spyware vendors. Its Controlium platform handled the de-anonymization, device fingerprinting, and delivery. One Discover-Tech server exposed four billion ad bid records, and its ads appeared across nearly 200,000 unique websites and mobile applications worldwide. The researchers also documented a separate actor, Dark Cartographer, building databases that link advertising identifiers to phone numbers by exploiting vulnerabilities at mobile carriers.
Google and IAB Europe removed the company from their ad vendor registries in early October. Google also cut off its access to ad exchange platforms, and Beeswax and Eskimi took similar steps.
Why this is a GRC story
Marketing technology is a supplier population that rarely reaches a vendor risk assessment. A single ad script can run on every page and in every app a business ships, reaching customers and staff alike, and it changes without a change request. Third party risk programmes that count SaaS contracts but not ad tags are counting the wrong things.
The data question follows immediately. Advertising identifiers were treated as commercial plumbing rather than personal data. Once they can be tied to a phone number and a real person, they become the same identifier class a privacy programme is supposed to govern, with lawful basis, retention limits, and disclosure duties attached.
There is a detection gap as well. Nothing here looks like malware to an endpoint tool, because the delivery vehicle is an ad impression in a browser or app that users were meant to load.
What to watch
Citizen Lab's recommendation is blunt: block targeted ads at the gateway until the industry proves it can block vectors of this kind. Watch whether regulators start treating ad exchange participation as a supplier relationship that carries due diligence duties, and whether procurement asks vendors for evidence that they were ever on a registry at all. The cheap control is an inventory of every third party script loading on your properties, with an owner and a review date attached.
Attribution: Analysis based on SecurityWeek and related public reporting. This article is original commentary, not a repost of the source material.