The Omnomnomicon

AdFection hardening runbook

11 min read

This runbook contains steps to harden personal devices (Kubuntu, Android, Windows, macOS) against AdFection, the spyware technique documented by Citizen Lab on October 15, 2026. AdFection is a delivery technique that uses website and app advertising networks to deploy spyware (in the documented case, Candiru’s) onto target machines upon page load.

The systems the malware exploits

AdFection exploits standard online advertisement auction processes and systems. When a webpage or mobile app has an ad slot and the page containing it loads:

  1. The app/page code running on the user’s device sends a request (bid) to an ad exchange
  2. Advertisers automatically bid for the chance to show that user an ad
  3. The exchange picks the winner and pushes the ad

All of this happens in under a second, hundreds of billions of times a day. Two kinds of platform sit between the parties:

  1. Advertisers buy through a demand-side platform (DSP)
  2. Sites and apps sell ad slots through a supply-side platform (SSP)

The bid carries data about the user so buyers can decide whether it’s worth their money to bid. Most data comes from SSP code embedded in the website the user visits or the SDK used to develop the mobile app, but some is supplied by the user’s mobile carrier itself:

Data typeData source
Mobile advertising IDCore function of Android and iOS
Device detailsSSP code
Precise locationSSP code
IP addressSSP code
Site/app containing the ad slotSSP code
Ad slot specs (format, placement, price, restrictions, security flag, supported APIs, SDK used)SSP code
Ad-firm cookie IDsAd firms’ tracking code in the browser, exchanged between firms by ID syncing
Page cookiesAd’s script, reading cookies set on the page showing the ad
Real IP behind a VPNAd’s script, via WebRTC leak
Phone numberMobile carriers’ “header enrichment”, frequently used for convenience (e.g. letting a site recognize a user by phone number to sign in automatically)

A combination of this information easily allows advertisers to target a single person. And since the winning ad can include code for the target machine to execute within the ad slot, that provides the payload delivery mechanism.

An Israeli ad firm, Discover-Tech, bought ad slots that included the ability to deploy a script. On load, the script gathered information about the client machine, then sent it to the Discover-Tech server to check it against a list of targets. Non-targets saw a normal ad, while targets got code that loaded a browser exploit that installed Candiru’s spyware. Because the malware only went to chosen devices, the networks serving the ads never saw it.

The payload found in the Al Jazeera sample machine was a Windows DLL persisting via COM hijack; this lets the malware run in a process the host system classified as legitimate.

Hardening procedure

Linux desktop (Kubuntu)

  1. Automatic security updates: patches known bugs on the user machine; sudo apt install unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades
  2. Block ads: removes a major distribution channel; install uBlock Origin in Firefox and keep its default filter lists on
    • Chrome doesn’t support full uBlock Origin, only uBlock Origin Lite (it can’t run its own filtering logic, and its main lists update only with extension updates); prefer to switch primary browsing to Firefox and use Chrome only if sites are broken
  3. Block third-party cookies: removes one way to target a specific device
    • Firefox: Settings → Privacy & Security → Enhanced Tracking Protection → Strict
    • Chrome: Settings → Privacy and security → Third-party cookies → Block third-party cookies
  4. Turn off JavaScript JIT: JIT speeds up page code by sacrificing security, in that browsers with it on skip interpreting every line of page code and instead convert frequently-run elements into machine code
  5. Stop WebRTC IP leaks
  6. Configure system-wide DNS filtering: block advertising domains; set a filtering DNS resolver in NetworkManager for each connection, or run a Pi-hole device on the network

Android

  1. Automatic updates: patches known bugs on the user machine; install system updates, and update Chrome and Android System WebView from the Play Store
  2. Delete the advertising ID: removes one way to target a specific device; Settings → Privacy → Ads → Delete advertising ID, which removes the ID without issuing a new one
  3. Configure Private DNS filtering: blocks advertising domains, including in apps; Settings → Network & internet → Private DNS → enter a filtering provider’s hostname
  4. Turn on Advanced Protection (Android 16): turns on Android’s most effective security features; Settings → Security & privacy → Other settings → Advanced Protection → turn on Device protection
  5. Turn off JavaScript JIT in Chrome: Advanced Protection already does this in Chrome; if you skip Advanced Protection, use Chrome → Settings → Privacy and security → Security → JavaScript optimization and security → turn off the V8 optimizer
    • This is a Chrome setting, so ads shown inside other apps’ web views may not be covered
  6. Block ads and third-party cookies in a browser that supports extensions: removes a major distribution channel; install Firefox, add uBlock Origin with its default filter lists on, and set Settings → Enhanced Tracking Protection → Strict
    • Chrome on Android can’t run extensions, so use Firefox as the primary browser
  7. Cut ad-funded apps: removes exposure to in-app ads; remove or pay for ad-free versions of ad-heavy apps

Windows and macOS

Both platforms take the same Firefox and Chrome steps as Kubuntu (uBlock Origin, third-party cookie blocking, JIT off, WebRTC leak prevention). Platform-specific steps:

Windows

  1. Automatic updates: patches known bugs on the user machine; leave Windows Update and browser auto-update on
  2. Turn off the advertising ID: removes one way to target a specific device; Settings → Privacy & security → General → turn off personalized ads using your advertising ID
  3. Turn off JavaScript JIT in Edge (if you use Edge; Firefox and Chrome follow the Kubuntu steps): Edge → Settings → Privacy, search, and services → Security → Enhance your security on the web → Strict
  4. Configure system-wide DNS filtering: blocks advertising domains, including in apps; Settings → Network & internet → your connection → DNS server assignment → a filtering resolver, encrypted if offered

macOS

  1. Automatic updates: patches known bugs on the user machine; leave automatic updates and Background Security Improvements (the successor to Rapid Security Responses) on; check System Settings → Privacy & Security → Background Security Improvements
  2. Turn off personalized ads: removes one way to target a specific device; System Settings → Privacy & Security → Apple Advertising → turn off Personalized Ads
  3. Turn on Lockdown Mode: disables JIT JavaScript compilation in web browsing unless you exempt a site; System Settings → Privacy & Security → Lockdown Mode
    • This acts on Apple’s WebKit engine, so Firefox and Chrome need their own JIT settings
  4. Configure system-wide DNS filtering: blocks advertising domains, including in apps; System Settings → Network → your connection → Details → DNS → a filtering resolver, encrypted if offered

Checking your work

  1. WebRTC
    • Check: turn on your VPN and open BrowserLeaks WebRTC
    • Expected result: your real public IP doesn’t appear
  2. Ad blocking
    • Check: load a news site that normally shows ads
    • Expected result: the uBlock icon shows a non-zero count and ad slots stay empty
  3. DNS filtering
    • a. Desktop (Kubuntu, Windows, macOS)
      • Check: run nslookup mtrtb.com (a Discover-Tech domain)
      • Expected result: a filtering resolver that lists it returns 0.0.0.0 or no answer
        • A normal IP means your list doesn’t cover it
        • An error with no answer can also mean a failed lookup, so retry with a known good domain
    • b. Android
      • Check: open Settings → Network & internet → Private DNS, then load mtrtb.com in the browser
      • Expected result: Private DNS shows your provider’s hostname, and the page fails to load
    • c. Windows
      • Check: open Settings → Network & internet → your connection
      • Expected result: DNS server assignment lists your filtering resolver
    • d. macOS
      • Check: open System Settings → Network → your connection → Details → DNS
      • Expected result: the DNS tab lists your filtering resolver
  4. JavaScript JIT
  5. Advertising ID
  6. Platform hardening mode
  7. Automatic updates (Kubuntu)
    • Check: run systemctl status unattended-upgrades
    • Expected result: the service reports active

Gaps left after all that work

You’ve just made it more expensive and complicated for an attack to land on your device, but your devices still aren’t bulletproof.

  1. Zero-day exploits still work: only if a bug is already known can an update patch it; while turning off JIT narrows the attack surface, it’s not closed since recent Chrome builds can still run WebAssembly with the V8 optimizer disallowed, depending on version and platform
  2. Blocklists lag behind the reality of the rotating infrastructure used by attackers: Discover-Tech moved between many domains and also used CloudFront distributions; no one can decisively block a not-previously-known domain, and pre-emptively blocking shared CDN hostnames will also break legitimate sites
  3. Browser controls don’t touch in-app ads: in this case, most ad bids were embedded in mobile apps
    • Also complicating things: if an app uses its own encrypted DNS, this bypasses system DNS filtering
  4. Removing advertising IDs still leaves IP targeting possible: attackers can target a device by IP address alone, and home IP addresses tend to be persistent and stable. Worse, ads served to non-targets still sent device data back to Discover-Tech, including the public IPv6 address
  5. Mobile carriers leak phone numbers via header enrichment: a different attacker used Discover-Tech infrastructure to exploit header enrichment, mapping advertising IDs to carrier-issued phone numbers (this relies on plain HTTP requests); no step above stops this, and the only user-side mitigation is avoiding plain HTTP (for example with HTTPS-only mode) or using Wi-Fi instead of cellular
  6. Attacker can still deliver exploit via non-ad means: the Candiru attack has also succeeded via a compromised news website, not via ads; the ad-specific steps (ad blocking, DNS filtering, advertising-ID removal) don’t defend against this or against zero-click malware delivered via messengers; only the general steps (updates, JIT off, Lockdown Mode, Advanced Protection) still help
  7. Attacker can still build a profile without ads: Discover-Tech’s ID syncing typically happened during website visits even when the user never received a Discover-Tech ad
  8. Users can’t detect infection: Al Jazeera used network logs to confirm infections; users have almost no reliable way to tell an infection has happened

Sources

Graph View