Spyware vendors found a way to make targeted ads even worse

security

Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google’s seal of approval

The online advertising industry has found a new way to make itself even more unpopular, with one adtech outfit accused of helping spyware vendors infect people’s phones without them even clicking an ad.

Researchers at Citizen Lab say they’ve uncovered the first publicly confirmed case of a zero-click mercenary spyware attack being delivered through targeted online ads, with devices at Al Jazeera among those infected.

The technique, dubbed “AdFection,” turns advertising networks into a spyware delivery system. Simply opening a website or app can be enough to trigger the attack, with no suspicious links or downloads involved.

Israeli adtech firm Discover-Tech is allegedly behind the operation, according to researchers at Citizen Lab, which says the company acts as a middleman between the online advertising industry and multiple spyware and hacking vendors.

“We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse,” the researchers wrote. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose.”

Discover-Tech’s Controlium platform exploits the real-time bidding system that decides which ads appear on websites and apps. Every time someone loads a page, advertisers compete for available ad space and, in the process, receive information about the user’s device and location. Discover-Tech allegedly used that data to identify specific targets and serve them malicious ads. 

One spyware vendor linked to the operation is Candiru, the Israeli developer now known as Integrity Labs. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech.

Discover-Tech didn’t have to sneak into the advertising system, as Google and IAB Europe had listed the company as an approved vendor since 2020, apparently unaware of what it was Citizen Lab claims it was doing with that access.

Citizen Lab sifted through nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026.

Some reached networks belonging to government agencies, defense organizations, and NATO. Researchers found no evidence that those organizations were infected, but they say the ads could have been used to profile devices on those networks.

The researchers said the operation also covertly directed millions of devices toward servers associated with Candiru, although those connections don’t necessarily indicate spyware infections.

Google has since terminated Discover-Tech’s access to its advertising exchanges and removed it from its approved vendor lists. IAB Europe followed suit, while Beeswax, Vungle and Eskimi also took action.

Discover-Tech and Candiru did not respond to Citizen Lab’s requests for comment, nor ours. 

The researchers argue that the findings expose serious failings in an advertising industry that allowed a company with links to commercial surveillance operators to operate inside its supposedly vetted ecosystem for years.

“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.

For years, the worst thing about targeted advertising was that it knew far too much about you. Turns out some advertisers were interested in much more than your shopping habits. ®