Discover-Tech Linked to Zero-Click Spyware Delivered Through Online Ads
Researchers found that digital advertising networks were used to profile targets and secretly install surveillance tools on devices.
15 Oct 2026 0 reads Compiled with AI
#Discover-Tech #Citizen Lab #Candiru #Google #Al Jazeera
Security researchers at The Citizen Lab have revealed that commercial spyware vendors used digital advertising networks to target and infect devices with zero-click surveillance software. The campaign, which researchers named AdFection, required no user interaction or clicks. According to the investigation, an Israeli advertising company called Discover-Tech operated as a bridge connecting the ad ecosystem with mercenary spyware makers, including Candiru, which has also operated as Integrity Labs, and Bindecy.
Discover-Tech ran a system called Controlium alongside ad bidding servers that could profile devices and deliver malicious code. The company used a tag pointing to servers that checked incoming device identifiers and internet protocol addresses before sending exploit scripts or returning blank responses. TechCrunch reported that exposed code and dashboard records on Discover-Tech's website allowed researchers to access login data that included accounts used by employees at Candiru and Bindecy.
Reach on sensitive networks
Between March and June 2026, Discover-Tech's MyDSP platform bid on nearly 3.77 billion ad impressions and won about 442 million. CyberScoop reported that its ads appeared on more than 120,000 websites and 70,000 mobile apps, while Security Affairs noted a Reuters report citing 75,000 apps, and Citizen Lab recorded nearly 200,000 sites and applications combined. Researchers confirmed ad impressions on sensitive networks belonging to NATO, the U.S. Department of Defense, the United Nations, and the International Criminal Court, though an ad impression does not indicate an infection.
The investigation verified active intrusions against the news network Al Jazeera, where at least 45 devices were targeted between 2024 and 2025 using Candiru spyware delivered through Discover-Tech ads. TechCrunch reported that these targeted devices were Windows computers. The researchers also found a threat actor called DARK CARTOGRAPHER using Discover-Tech infrastructure to map phone numbers to ad identifiers across mobile carriers. Following the disclosures, Google and IAB Europe removed Discover-Tech from their approved vendor lists, while platforms including Beeswax and Eskimi cut off its access.