2026年10月15日，公民实验室的研究人员揭露了“AdFection”行动，该行动由以色列广告公司Discover-Tech allegedly 将目标引导至与开发商Candiru关联的间谍软件服务器。
Citizen Lab Exposes 'AdFection' Campaign Delivering Zero-Click Spyware via Digital Ads On October 15, 2026, researchers at The Citizen Lab revealed 'AdFection,' a campaign where an Israeli advertising firm, Discover-Tech, allegedly routed targets to spyware servers linked to developer Candiru.
该攻击利用数字广告基础设施实施零点击感染，无需用户交互。
The attack exploited digital ad infrastructure to execute zero-click infections, requiring no user interaction.
2024年至2025年间，该行动通过Discover-Tech的Controlium平台针对半岛电视台的45台设备。
Between 2024 and 2025, the campaign targeted 45 devices belonging to Al Jazeera through Discover-Tech's Controlium platform.
公民实验室发现恶意广告脚本标签在超过7万款应用和12万个网站上被投放，广告展示在国际政府网络中被检测到。
Citizen Lab found evidence that malicious ad script tags were served across more than 70,000 apps and 120,000 websites, with ad impressions detected on international government networks.
联合调查后，谷歌将Discover-Tech从其广告平台移除，康卡斯特旗下的Beeswax也将其剔除，IAB欧洲将其从全球供应商名单中暂停。
Following joint investigations, Google blocked Discover-Tech from its ad platforms, Comcast-owned Beeswax removed the company, and IAB Europe suspended it from its global vendor list.
Discover-Tech及其母公司Candiru的母公司未对置评请求作出回应。
Discover-Tech and Candiru's parent firm did not respond to requests for comment.