This is an executive summary for our report "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware."

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

This is an executive summary for our report "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware."

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveill…

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

# Watching for AdFection infrastructure after the takedowns Public takedowns can reduce an operation's reach without leaving every host offline at the same time. Domains may remain resolvable, old certificates may persist, or a service may move to another front end. The Discover-Tech case offers a reason to monitor the gap between an enforcement announcement and the disappearance of observable infrastructure. Citizen Lab reported that Google and IAB Europe removed Discover-Tech from vendor lists in early October 2026, while Beeswax terminated access, Vungle paused access for a review, and Eskimi blocked accounts and domains. The report also lists general Discover-Tech domains, several NOAS servers, Candiru validator names, and command-and-control names. It describes the evidence as historical activity observed during the investigation. Those actions are important. They do not convert every reported host into a permanent indicator or every absence into proof of cleanup. A monitoring plan should track both cases and preserve the time of each observation. ## Observe the current surface A public search at 2026-11-03 found no current matches for several named domains. `domain="mtrtb.com"` returned zero at 15:41:23, `http.body="mtrtb.com"` returned zero at 15:41:43, and `domain="discover-tech.io"` returned zero at 15:41:33. `domain="powerium.net"` and `http.body="powerium.net"` also returned zero at 15:41:53 and 15:42:04. These are successful queries with zero-count results. They show that the selected public index did not expose those strings at those times. They do not prove that every NOAS server is gone. The report says the servers could return nothing to unselected visitors, and a search engine's request may not resemble an eligible device. The broader market remains visible. `http.body="adsbygoogle"` returned 621,764 web responses at 15:40:52, and the port 443 subset returned 274,280 at 15:42:15. That larger surface is not evidence of continuing AdFection activity. It is a baseline for understanding how commonly ad-client code appears across public pages. ## Monitor relationships, not only names A replacement domain can inherit an old role without reusing a name. Monitor certificate fields, CNAMEs, hosting names, ASNs, and page metadata that were connected to the reported operation. For example, Confiant reported a shared AWS load balancer and Wix account metadata among several properties. Those relationships can help an analyst examine a new host, but they can also produce false associations when infrastructure is shared. Build alerts around combinations. A new domain that shares a known certificate with an ad-serving property and is contacted after an ad render is more interesting than either fact alone. A contact to a validator followed by a command channel is more meaningful than a single low-reputation domain hit. The order and context carry information. ## A continuous review cycle Run the domain inventory on a schedule that matches the risk. Record the exact query, scope, result, and error status each time. Compare changes in DNS, certificates, and public response content. Review the list after a new vendor enforcement action or after a corporate ownership change. Keep an archive of historical positive observations. A current zero should not overwrite the evidence that a domain or relationship existed. The archive allows an analyst to explain why an old indicator still appears in a detection rule and when it stopped matching public data. ## Response after a new hit If monitoring finds a related host, do not begin with a public accusation. Check internal DNS and proxy logs, identify the device and process, and preserve the response. Determine whether the contact came from an ad, a user action, or an unrelated service. Then decide whether the host belongs in a blocklist, an alert, or a watchlist. Citizen Lab recommends blocking targeted ads at the gateway until the industry can show that it can reliably stop AdFection-style delivery. That policy addresses the execution path directly. Infrastructure monitoring supports the policy by showing whether old or new hosts continue to appear inside the environment. The discipline after a takedown is the same as before one: record what was observed, when, and with what scope. A current zero is useful. It is not a guarantee, and it is not a substitute for endpoint evidence. ## References * Citizen Lab, Exposing AdFection * IAB Europe statement on Discover-Tech * Confiant, ADINT: Weaponized Ad Tech

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the…

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the tar...

Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur publicitaire légitime, identifiée comme facilitateur de spyware mercenaire via sa plateforme Controlium.

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the ta…

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly...

Discover-Tech soll über Online-Werbung Spyware installieren. Ganz besonders soll sich die israelische Firma für Starlink-Nutzer interessieren.

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur publicitaire légitime, identifiée comme facilitateur de spyware mercenaire via sa plateforme Controlium.

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly...

Έρευνα του Citizen Lab τεκμηριώνει για πρώτη φορά ότι κατασκοπευτικό λογισμικό εγκαθίσταται σε συσκευές μέσω στοχευμένων διαφημίσεων, χωρίς ο χρήστης να χρειαστεί να πατήσει οτιδήποτε. Εδώ και χρόν...

Discover-Tech soll über Online-Werbung Spyware installieren. Ganz besonders soll sich die israelische Firma für Starlink-Nutzer interessieren.