Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

The report

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

Read the full analysis: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware (The Citizen Lab).

Indicators

Adware Tracker

• sincereaccertain[.]com
• logger[.]powerium[.]net
• mydsp[.]io
• checkmyimp[.]com
• cookiesurfer[.]com
• nutralove[.]co

Spyware C

• fearevolve[.]com
• insightenterprisells[.]com
• jobmarcher[.]com
• plasticbells[.]com
• outdooutcome[.]com
• suggestutterly[.]com
• keyadapter[.]com
• sharethere[.]net
• adv45[.]volasim[.]com
• adv50[.]volasim[.]com
• www[.]controlium[.]net
• noas[.]adtimizer[.]co
• events[.]platc-tester[.]com
• noas[.]impchkdsp[.]com
• noas[.]powerium[.]net
• qa-noas[.]powerium[.]net
• noas[.]trakking[.]co
• powerium[.]net

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#17). This page is generated from that record and the report’s own title and summary; nothing is rewritten.