Israeli advertising firm Discover-Tech used ordinary-looking online ads to profile millions of phones and computers and hand-selected targets for Candiru’s mercenary spyware, infecting devices at Al Jazeera without the victims clicking anything, the University of Toronto’s Citizen Lab said on 15 October 2026.
The lab calls the technique AdFection and describes it as the first publicly available technical confirmation of zero-click spyware delivered via targeted advertising. Ad-security firm Confiant published a parallel investigation on the same day.
AdFection works because a modern online ad is not just a picture. In real-time bidding (RTB), the sub-second auction that decides which ad a person sees, the winning buyer can attach JavaScript that runs inside the app or browser showing the ad. Discover-Tech won those auctions through its own platform, MyDSP, which bid on exchanges run by Google, Yandex, Vungle (owned by Liftoff) and China’s Sunteng. It also bought ads through Comcast-owned Beeswax and Lithuania’s Eskimi.
Many of those ads carried a script tag that called back to a Discover-Tech “NOAS” server, which checked the viewer’s IP address and advertising ID. Almost everyone got an empty, zero-byte .
A chosen target instead received code that opened an invisible 1×1-pixel frame pointing at a Candiru validator server, which vetted the device before sending it on to an exploit server. Because the malicious code reached only the selected device, the companies serving the ads never saw it. Eskimi told Citizen Lab the advertiser’s tags “were built to evade automated scanning.”
At least 45 devices inside Al Jazeera were targeted in 2024 and 2025, according to the report. Network logs the broadcaster handed to researchers show the same sequence on infected machines: an ad impression from the Discover-Tech infrastructure, a Candiru validator check within seconds, an exploit server, and then command-and-control traffic within 1 to 3 minutes.
Al Jazeera recovered a Windows DLL that Citizen Lab assessed with high confidence as a newer build of the Candiru chain it exposed in 2021 . The researchers wrote that “the simple display of a targeted ad is enough for infection.”
A spyware console that leaked its own customer list
Discover-Tech’s customers worked through a web platform called Controlium. It let them upload target lists of mobile advertising IDs, Beeswax cookie IDs and IP addresses, pick a payload type that included an option labelled “De-anon”, and restrict campaigns by country. Admins could also set “OpSec” limits so that customers did not bid too often or too broadly, thereby exposing themselves.
The operation was far less careful with its own data. Controlium shipped its entire front-end code on the login page, and the correct code for validating sign-in tokens had been commented out in favour of a version researchers said could be spoofed. An unauthenticated download endpoint handed over 128 days of login records covering 120 usernames.
Citizen Lab traced two of them to Integrity Labs, the rebranded Candiru, at least 15 to ad-intelligence firm Intelos, and others to Israeli exploit developer Bindecy. One unattributed account logged in mostly from India. Two world-readable databases on Discover-Tech’s mtrtb.com domain exposed nearly four billion ad-bidding records, which is how the scale of the operation came to light.
An ad network that sold almost nothing
Between March and June 2026, MyDSP bid on 3.77 billion ad impressions and won 442 million of them. Around 719 million bids, roughly 19%, were for ads carrying the NOAS script tag. Ads of that kind actually ran in 75,373 Android and iOS apps and on 120,768 websites. Apps showing more than a million downloads included MX Player and Lark Player.
Viber showed 700,000 on Android, and Truecaller and Snap VPN each showed around half a million. The websites ranged from weather.com to bbc.com and nytimes.com.
The bidding database listed just three advertisers, and nearly all of the activity traced back to Discover-Tech itself or to linked properties: the Akedo gaming platform, the MyIPInfo lookup site, and a generic AliExpress “SALE” banner that pointed to an affiliate link. MyDSP spent $109,091 over four months, and every revenue and conversion field in the records was zero.
Confiant estimated that Discover-Tech served 10 million impressions a day and that roughly 60% of its August ads were affiliate placements. The firm concluded that the operator’s “deniability is strong, and there is no obvious monetization chain.”
Confiant also found that Discover-Tech’s ad code copied the host website’s first-party cookies. Across more than 1,000 publisher domains, the collection included logged-in session IDs and sometimes names and emails stored in tokens, and it ran even where the company had no GDPR consent.
The targeting was deliberate. By raw bids, Yemen (457 million) and Pakistan (139 million) led, while Montenegro topped the per-capita count. In Confiant’s data, one in every 36 Android ads shown in Palestine came from Discover-Tech. Impressions also landed on networks belonging to NATO, the United Nations, the European Parliament, Sweden’s Armed Forces, Saab, Intel and Nvidia.
Confidently, separately saw them on networks of the US Department of Defence, the International Atomic Energy Agency and the International Criminal Court. Both teams caution that an impression on an organisation’s network shows profiling, not confirmed infection.
Certified by the ad industry for six years
Discover-Tech appeared on Google’s lists of certified external vendors and ad-technology partners from 2020, and was registered as vendor 778 on IAB Europe’s consent framework Global Vendor List as of 2 July 2020. That registration meant European consent pop-ups could present the company as an approved data processor.
Corporate records cited by Citizen Lab show that spyware veteran Eric Banoun, co-founder of Circles and Senpai and a shareholder in Intelos, sat on Discover-Tech’s board from 2020 to 2025. Until March 2026, a shareholder company was linked to Sara Hamou, who managed the corporate network of Predator maker Intellexa.
Google said it blocked Discover-Tech from its ad platforms for “systematically violating our policies” . IAB Europe removed the company on 8 October; Beeswax dropped it; Vungle paused its access pending a review; and Eskimi blocked its accounts. Discover-Tech, Candiru, Bindecy, Intelos, Microsoft’s Xandr and Sunteng did not respond to requests for . Linked firms Adtimizer and Volasim denied any involvement in spyware activity.
Ad-based spyware delivery had surfaced before. Investigators described Intellexa’s “Aladdin” malicious-ad vector in late 2025, but without in-the-wild infection evidence of the kind recovered at Al Jazeera.
Citizen Lab recommends that organisations block ads at the network gateway. Individuals can reduce exposure by using an ad blocker and by resetting or disabling the mobile advertising ID in their phone’s privacy settings. For background, see Cyber Kendra’s coverage of mercenary spyware .
Several questions remain open. It is still unknown which government customers Candiru served through Discover-Tech, and whether anyone on the NATO, ministry or defence networks was actually compromised.
Citizen Lab says a second report is coming on a group it calls DARK CARTOGRAPHER. That group used Discover-Tech ads to obtain phone numbers from mobile carriers in more than 30 countries, and its infrastructure is linked to a US government contractor.
Join the conversation. Ask questions, solutions, and help others.
Be the first to start the discussion!
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
