The researchers at Citizen Lab have found a new zero day no click spyware, the most alarming factor is that the spyware is delivered via targeted digital advertisements, The ad-based zero-click delivery mechanism facilitated by Discover-Tech now dubbed “AdFection,”, by the researchers at Citizen Lab, gives a new meaning to zero click spyware. The report states the ads must merely load, for the system to be infected, the user doesn’t even have to engage the system
The report was released by Citizen Lab, on 15th Oct 2026, the supposed mercenary spyware is said to be from “Candiru” an Israeli Cyber security Company, already quite famous for its Devils Tongue spyware, and company included the U.S Entity list for Malicious Cyber Activities. The notable thing is while Candiru was sanctioned by U.S for its spyware operations, this very firm was acquired by a U.S Investment firm Integrity Partners, for $ 30 Million, and rebranded as Integrity Labs, allowing it to circumvent, the sanctions. The company apparently continued to do its work, and the result is AdFection. The new Candiru i.e Integrity Labs, was able to gain the ads via yet another organization an Israeli Ad Agency “Discover-Tech”, in the Citizen Lab report, the ad company operates platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices, Discover Tech runs ads to several companies, ranging from Google, Comcast, Yandex, the company is said to have leveraged the European GDPR consent framework to target people within EU.
Figure 3 : (Ciziten Lab) Discover-Tech bridges the mercenary spyware industry with the online advertising ecosystem.
The Above is a concise version of the infection chain (Generated by Author)
Attribution of the Attack to Candiru
The Citizen Lab uncovered the Discover-Tech pipeline while investigating compromised systems at the international news network Al Jazeera, where at least 45 Windows devices were infected between 2024 and 2025. The infected devices first contacted Discover-Tech’s “NOAS” gatekeeper servers upon loading an ad impression. While these gatekeeper servers return a harmless 0-byte response to ordinary users to evade detection by ad exchanges, they dynamically redirected the targeted Al Jazeera devices to a Candiru validator server for device fingerprinting before deploying the exploit.
The attribution to Candiru was confirmed at network and host levels. Candiru domains identified via server fingerprinting, by citizen lab matched infrastructure previously attributed to Candiru by threat intelligence firms like Sekoia and Recorded Future. The researchers isolated a malicious Windows DLL implant from one of the compromised Al Jazeera machines. The DLL contained hardcoded Command-and-Control (C&C) domains (fearevolve[.]com and jobmarcher[.]com) alongside code-level signatures specifically a COM hijacking persistence mechanism and a string obfuscation routine that directly matched Candiru payloads analysed by the Citizen Lab in 2021. The sample is available on Virus total
As Wolfie Christl, a senior researcher at the Citizen Lab, told Reuters: “The way online advertising works today is a systemic security threat. For states, the private sector, civil society and everyone else alike.”
Why it matters to India
The threat actor identified in the Citizen Lab report, “Dark Cartographer,” turns this ad-tech vulnerability into an acute national security threat. Using Discover-Tech’s infrastructure, the group exploited flaws in cellular networks to map anonymous device advertising IDs directly to real subscriber phone numbers. In the Indian digital ecosystem, a mobile number is far more than a contact detail, it serves as the primary identifier tying together banking, UPI, Aadhaar, and SMS-based two-factor authentication.
Foreign intelligence agencies can simply buy geofenced ad slots focus targeting military bases, DRDO labs, or defence public sector units to unmask the personal phone numbers of officers and scientists working inside. Keeping official defence networks air-gapped will not stop this. Adversaries can bypass isolated military systems entirely by tracking personnel through their personal handsets or targeting software engineers at private defence subcontractors. Making matters worse, this covert surveillance vector coincides with a sharp escalation in automated cyber operations against domestic infrastructure.
On October 15, 2026, the same day the Citizen Lab findings went public CERT-In issued a critical advisory (CIAD-2026-0049) which revealed that rogue AI agents under testing and hackers used open-source AI tools to breach live Indian enterprise systems and read confidential records. As Reuters noted the following day, not a single compromised Indian firm caught the intrusion on its own; they only learned of the breaches after external AI companies notified them. Just six days earlier, another CERT-In alert (CIAD-2026-0046) detailed how attackers used AI-assisted tools to rob Indian fintech and financial firms. After pulling plaintext passwords from configuration files, harvesting static API tokens, and forging code commits, intruders triggered unauthorized IMPS and NEFT transfers straight from the victims’ own whitelisted servers. Operations that once took days from initial access and to the final theft now take just a few hours.
Conclusion
When commercial ad exchanges like Google, Comcast, and Yandex can silently deliver zero-day exploits the moment a webpage loads, the digital advertising ecosystem itself becomes an active attack vector. State-sponsored APTs and foreign intelligence agencies rarely attack air-gapped defence networks head-on; instead, they target the personal devices of the personnel who work inside them. Defending Indian military establishments, DRDO laboratories, DPSUs, and private defence subcontractors therefore requires looking beyond isolated official networks. At the gateway level, sensitive organizations must strip out third-party ad traffic entirely by blocking Real-Time Bidding (RTB) domains, enforcing remote browser isolation, and blacklisting known validator and C2 infrastructure such as (fearevolve[.]com and jobmarcher[.]com) Operational security for personnel needs an equally strict overhaul.
Defence officers, scientists, and subcontractor engineers should leave personal handsets outside sensitive zones to defeat geofenced targeting and move critical workflows off SMS-based two-factor authentication. Meanwhile, Indian telecom operators must patch the cellular network flaws that allow ad platforms to tie device advertising IDs to subscriber phone numbers in the first place, but rather than relying on telecom networks, organizations should Real-Time Bidding (RTB) ad traffic and known Command-and-Control domains at the network gateway enforcing browser policies that stop third-party ad scripts and hidden redirects from running on official machines, and keeping personal phones off internal networks. Hardening mobile perimeters is only half the battle. Stopping the rapid, AI-assisted intrusions highlighted in recent CERT-In advisories requires fixing foundational credential hygiene before automated tools can exploit it.
Indian enterprises and fintech firms need to purge plaintext passwords from configuration files, replace static API tokens with short-lived rotating credentials, and enforce cryptographic checks on every code commit. Financial networks cannot blindly trust traffic just because it originates from a whitelisted server, nor can Indian institutions wait around for foreign AI vendors to notify them after a breach has already occurred. Building domestic threat detection and real-time behavioural monitoring is the only viable way to stop both mercenary ad-tech spyware and automated intrusions before data or funds walk out the door.
