Advertising Espionage and the Global Surveillance Industry: Discover-Tech - Candiru and ...

An institutional OSINT investigation into zero-click spyware delivery, advertising intelligence, identity deanonymisation, commercial surveillance networks and the strategic vulnerability of the global digital advertising infrastructure.

Scope: This assessment examines the Discover-Tech investigation published on 15 October 2026, its documented operations between 2024 and 2026, comparable commercial surveillance actors internationally, the regulatory exposure of the United States, Israel, the European Union and the United Kingdom, and the strategic outlook through October 2031.

Executive Summary — Bottom Line Up Front

The principal technical investigation, published by the University of Toronto’s Citizen Lab on 15 October 2026, documents 3,770,286,576 advertising bids, 441,954,291 apparently successful bids, 120,768 websites and 75,373 applications within its March–June 2026 dataset. It also links Discover-Tech’s advertising infrastructure to Candiru spyware attacks against at least 45 devices at Al Jazeera during 2024–2025.

A separate investigation by Confiant provides technical evidence of malicious advertising code, device fingerprinting, concealed command-and-control communications and connections to commercial surveillance actors. Its findings reinforce the central technical assessment, although the two investigations were coordinated and should not be counted as wholly independent corroboration of every allegation.

The international comparison identifies several distinct categories of potentially relevant companies: spyware manufacturers, advertising-intelligence providers, mobile-location data brokers, commercial hacking intermediaries and ordinary advertising infrastructure operators. These categories must remain separate because technological similarity does not establish common ownership, operational cooperation or unlawful conduct.

The principal national-security concern extends beyond individual privacy. The same advertising architecture that allows companies to target consumers can expose the location, device characteristics, browsing patterns and potentially identifiable behavioural signatures of military personnel, diplomats, government officials, researchers, journalists and critical-infrastructure employees.

Principal judgment: Discover-Tech should be assessed as a documented example of a broader structural vulnerability in the digital advertising economy, rather than as evidence that every surveillance company uses the same technique. The immediate institutional requirement is to treat advertising-data exposure and advertising-script execution as interconnected cybersecurity, counterintelligence, procurement and regulatory risks.

The Discover-Tech investigation exposes a structural failure in the global digital economy: commercial advertising systems can provide intelligence operators with access to individuals, institutions and devices that traditional cybersecurity controls were never designed to protect.

The numbers reveal an intelligence infrastructure, not an advertising campaign

The scale of Discover-Tech’s operations is central to understanding the significance of the investigation, although the figures require careful interpretation. Citizen Lab analysed 3,770,286,576 advertising bids between March and June 2026, identifying 441,954,291 apparently successful bids, with activity distributed across 120,768 websites and 75,373 mobile applications. Mobile applications accounted for 76.7% of the recorded bids, compared with 23.3% for web browsers. Within the analysed MyDSP dataset, Yandex represented 67.4% of recorded exchange activity, Google Ad Manager 24.74% and Vungle 7.24%.

The geographical distribution reinforces the need to distinguish commercial reach from confirmed targeting. Citizen Lab recorded 457,283,658 bids associated with Yemen, 139,427,322 with Pakistan and 97,595,716 with Montenegro. Population-adjusted observations placed Montenegro at 156.68 recorded bids per capita, compared with 13.99 for Yemen. These concentrations warrant investigation, but neither the absolute volumes nor the population ratios establish how many residents were identified, which governments were responsible or whether particular devices were infected.

The decisive evidence concerns Al Jazeera, where Citizen Lab linked Discover-Tech’s advertising infrastructure to Candiru spyware infections affecting at least 45 devices during 2024–2025. The broadcaster’s network records allowed investigators to associate advertising interactions with subsequent spyware-related communications. The case demonstrates the transition from potential advertising exposure to confirmed intrusive surveillance, without justifying the extrapolation of 45 infections to the billions of advertising transactions observed elsewhere.

Source: Citizen Lab, Exposing AdFection, 15 October 2026 .

The decisive vulnerability lies between commercial data collection and offensive cyber capability

Discover-Tech’s importance derives from its position between two previously distinguishable markets: commercial advertising intelligence and intrusive spyware. Advertising exchanges distribute information available impressions, devices and digital environments, while specialised surveillance suppliers develop capabilities to obtain access to protected systems. Controlium, the platform examined by Citizen Lab, connected advertising delivery with selective targeting and downstream code responses, creating a mechanism through which ordinary advertising activity could become an entry point for offensive operations.

The consequences are industrial as well as operational. A surveillance vendor possessing expensive exploitation capabilities can benefit from an intermediary already connected to extensive advertising inventory, while the intermediary can provide identification and delivery services without developing the complete offensive technology independently. The arrangement potentially reduces the need to expose specialised capabilities across large populations of devices, concentrating their use on selected targets.

This commercial complementarity explains why regulating spyware manufacturers alone cannot address the entire problem. The intelligence value may originate upstream, where ordinary advertising transactions distribute identifying information, before any prohibited exploit is delivered.

Source: Confiant, ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming, October 2026 .

Corporate fragmentation makes surveillance harder to regulate than to commercialise

The wider surveillance industry demonstrates how technological capabilities can be distributed across companies performing different development, ownership, financial and distribution functions. The United States Treasury’s actions of 5 March and 16 September 2024 identified a multinational structure associated with the Intellexa commercial spyware consortium, including companies established in Greece, Ireland, Hungary, North Macedonia and the British Virgin Islands.

The official record identified Cytrox AD as a developer of Predator spyware, Intellexa Limited as a technology reseller, Thalestris Limited as a holder of distribution rights and Aliada Group Inc. as a company involved in substantial financial transactions within the consortium network. Treasury described activity involving tens of millions of dollars, but that amount cannot be equated with consolidated revenue, profit or payments from any particular government.

Such structures matter because the company developing surveillance software may differ from the entity holding intellectual-property rights, signing procurement contracts or receiving payments. Export restrictions directed at one participant do not automatically establish the responsibilities of every associated legal person, while technical evidence of cooperation does not necessarily demonstrate common corporate control.

Discover-Tech’s own history illustrates a related distinction. The advertising technology associated with MyDSP predated the company’s incorporation in March 2020, while historical ownership and governance records identified relationships involving advertising businesses and individuals connected to the surveillance sector. These connections justify corporate investigation but do not establish that every historical shareholder, technology supplier or commercial counterparty participated in the subsequent Candiru operations.

The resulting regulatory difficulty is structural: commercial capability can be assembled through relationships that do not correspond neatly to the boundaries of a single company or national jurisdiction.

Source: U.S. Department of the Treasury, Sanctions Enablers of the Intellexa Commercial Spyware Consortium, 16 September 2024 .

Europe’s regulatory architecture governs the components but struggles with their convergence

The European Union possesses extensive legislation governing personal information, electronic communications, cybersecurity and surveillance-technology exports. Regulation (EU) 2016/679, the General Data Protection Regulation, establishes rules concerning personal-data processing, lawful purposes, security and international transfers. The ePrivacy framework governs defined forms of access to information stored on terminal equipment, while the Digital Services Act establishes obligations concerning advertising transparency for covered online platforms.

The legal architecture extends further. Directive (EU) 2022/2555, known as NIS2, addresses cybersecurity risk management and incident reporting for covered entities, while Regulation (EU) 2022/2554, the Digital Operational Resilience Act, applies a specialised resilience framework to the financial sector from 17 January 2025. Regulation (EU) 2021/821 provides export-control mechanisms for specified dual-use and cyber-surveillance items.

The difficulty is not simply the absence of legal instruments, but the separation of their purposes and enforcement authorities. A data-protection regulator may establish unlawful collection without identifying the customer directing an espionage operation; a cybersecurity authority may detect malicious code without determining beneficial ownership; an export-control authority may examine technology transfers without possessing the complete financial and operational record.

The Court of Justice of the European Union’s judgment of 7 March 2024 in Case C-604/22, IAB Europe, clarified important aspects of personal-data classification and controller responsibility within advertising frameworks. It did not establish automatic liability for every downstream activity conducted by every participating company. That distinction remains critical when a commercial exchange is used by an actor engaged in malicious surveillance: technical participation does not itself prove knowledge or complicity.

Source: Court of Justice of the European Union, Case C-604/22, March 2024 .

The United States has exposed the same vulnerability through commercial location-data enforcement

The American regulatory record demonstrates that the intelligence risks of commercial advertising extend beyond spyware delivery. In January 2025, the Federal Trade Commission finalised orders involving Mobilewalla, Gravy Analytics and Venntel, addressing practices concerning sensitive location information and its commercial distribution.

Mobilewalla is a particularly revealing comparator because the FTC restricted the collection of information from real-time advertising exchanges for purposes other than participation in the auctions. The case establishes that transaction data can possess commercial value independently of the advertising placement itself, while also demonstrating that the misuse of sensitive advertising-derived information can raise regulatory concerns without involving malware.

The enforcement record continued into 2026. The FTC announced a proposed resolution involving Kochava and Collective Data Solutions on 4 May 2026, followed by a stipulated order recorded in June. Together, these proceedings demonstrate sustained official concern the collection and distribution of commercially generated location information.

The distinction between American data-broker enforcement and the Discover-Tech spyware investigation remains important. The named data brokers were not thereby established as participants in AdFection. Rather, the proceedings expose adjacent vulnerabilities in the commercial information economy: data originally generated through consumer activity can acquire uses materially different from those associated with the service that collected it.

Source: Federal Trade Commission, Mobilewalla Final Order, January 2025 .

Over the 24 months, the cost of inaction will fall on institutions unable to control their external data exposure

Between October 2026 and October 2028, the most consequential decisions will concern whether governments and major technology platforms address advertising-derived information collection and malicious code delivery as related security problems, rather than relying exclusively on the exclusion of individual surveillance vendors.

The European exposure is not uniform. Italy must consider the dependencies affecting defence industries, energy, telecommunications and advanced manufacturing; France combines national cybersecurity responsibilities with established enforcement concerning advertising-data processing; Germany faces questions arising from industrial supply chains and specialised personnel; and the United Kingdom possesses an extensive regulatory record concerning real-time bidding and online tracking. NATO’s decision in July 2024 to establish an Integrated Cyber Defence Centre further reflects the strategic importance of security dependencies involving privately owned infrastructure, although it does not itself establish a solution to advertising-mediated surveillance.

The immediate costs of inaction will fall on institutions whose security programmes protect internal networks while leaving commercially generated information personnel and activities insufficiently understood. Governments and defence organisations face counterintelligence exposure; semiconductor and advanced-manufacturing firms risk disclosure of strategically relevant patterns; banks confront additional third-party technology and data-governance obligations; and media organisations face consequences for source confidentiality where surveillance progresses to device compromise.

The commercial burden will also reach advertising platforms. Vendor removals following the October 2026 investigation demonstrate that access to advertising markets can be restricted, but they do not establish that equivalent collection or delivery mechanisms have disappeared. Platforms that fail to demonstrate credible controls over downstream code and data recipients face continuing compliance, security and counterparty risks.

The governing choice is therefore between controlling the technical and commercial conditions that make advertising-derived surveillance possible, or repeatedly identifying individual operators after those conditions have already been exploited. The first requires investment in supplier assurance, data-flow visibility, code-execution controls and legally coordinated investigation; the second leaves the financial and security consequences with institutions whose ordinary commercial dependencies remain outside their effective control.

Navigational Index — Three Analytical Pillars

Pillar I — The Discover-Tech Architecture: Technical Mechanisms, Corporate Structures and Operational Evidence

Chapter 1. From Commercial Advertising to Intelligence Collection: Historical Development of ADINT and the Global Real-Time Bidding Economy

Chapter 2. Discover-Tech and Controlium: Corporate Identity, Ownership, Management, Infrastructure, Partners and Commercial Positioning

Chapter 3. The AdFection Method: Advertising Auctions, Identity Resolution, Device Fingerprinting and Zero-Click Spyware Delivery

Chapter 4. Operational Reconstruction: Candiru, Al Jazeera, Geographic Concentration, Sensitive Networks and the Limits of Attribution

Pillar II — Worldwide Corporate Intelligence: Surveillance Vendors, Advertising Intelligence, Commercial Data Brokers and International Networks

Chapter 5. The Israeli Commercial Surveillance Ecosystem: Candiru, NSO Group, Intellexa, Cytrox, Bindecy, Intelos and Related Corporate Networks

Chapter 6. The Global Advertising-Intelligence Industry: Commercial Data Collection, Identity Resolution, Geolocation Intelligence and Government Procurement

Chapter 7. Worldwide Comparative Corporate Investigation: North America, Europe, the Middle East, Asia-Pacific, Latin America and Transnational Supply Chains

Chapter 8. Corporate and Financial OSINT: Beneficial Ownership, Registries, Subsidiaries, Intermediaries, Acquisitions, Contracts, Export Controls and Sanctions Exposure

Pillar III — National Security, International Law, European Vulnerability and Strategic Countermeasures

Chapter 9. International Legal and Regulatory Architecture: GDPR, ePrivacy, Export Controls, Sanctions, Commercial Spyware and State Responsibility

Chapter 10. Comparative European Security: Italy, France, Germany, the United Kingdom and European Union Institutions

Chapter 11. Strategic Exposure of Governments, NATO, Defence Industries, Semiconductor Supply Chains, Financial Institutions and Media Organisations

Chapter 12. Counterintelligence and Defensive Architecture: Detection, Attribution, Vendor Assurance, Advertising-Supply-Chain Controls and Incident Response

Chapter 13. Strategic Scenarios 2026–2031: Technological Convergence, Surveillance-Market Evolution, Regulatory Responses and Indicators

Chapter 14. Institutional Courses of Action, Intelligence Collection Priorities and Final Net Assessment

The strategic transformation of advertising infrastructure

The disclosures concerning Discover-Tech represent an important development in the documented relationship between commercial digital advertising and offensive cyber operations because they demonstrate how technical functions originally developed to maximise advertising efficiency can be incorporated into a system for covert intelligence collection and selective device compromise. The relevant infrastructure was not designed exclusively for espionage: advertising exchanges, demand-side platforms, identifiers, bidding requests, audience segmentation and tracking scripts are ordinary components of the commercial internet. Their intelligence significance derives from the combination of extensive access to device-related information, highly automated distribution, persistent identity-linking mechanisms and the ability of certain advertising arrangements to execute third-party code within the user’s browsing environment. These functions become materially more dangerous when controlled by an actor capable of distinguishing a particular target from the broader advertising population and directing specialised code only towards that target. The Citizen Lab investigation describes precisely such an architecture through Discover-Tech’s Controlium platform and associated advertising-delivery infrastructure, while Confiant’s technical analysis independently establishes important characteristics of the concealed code-delivery and device-profiling mechanisms. Exposing AdFection — The Citizen Lab — October 2026 and ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant — October 2026 .

The convergence of advertising intelligence and mercenary spyware

The central corporate finding is that Discover-Tech appears to have occupied an intermediary position connecting conventional advertising infrastructure with commercial surveillance specialists. Citizen Lab identifies operational or corporate connections involving Candiru, also described in the investigation under the name Integrity Labs, together with Bindecy and Intelos, while examining a wider corporate environment in which persons and entities associated with the Intellexa network also appear. This creates several analytically distinct relationships: a technical connection may demonstrate that infrastructure was used to deliver or support particular capabilities; a historical shareholding may establish an ownership interest during a defined period; a common director may establish a governance relationship; and a researcher’s identification of overlapping network infrastructure may justify further investigation without independently proving that every associated company participated in the same operation. The distinctions are fundamental to corporate OSINT because complex international surveillance businesses frequently operate through different legal persons, contractual intermediaries and commercial brands, and the evidentiary requirements for identifying beneficial ownership are not equivalent to those for identifying operational infrastructure.

The comparison with other surveillance actors also demonstrates why the global industry should not be reduced to a list of companies described collectively as spyware manufacturers. The United States Federal Trade Commission has brought enforcement actions concerning the acquisition, processing and sale of sensitive geolocation information, including cases involving Gravy Analytics, Venntel, Mobilewalla and X-Mode/Outlogic. These proceedings establish that commercial location-data markets can create significant risks to consumers and sensitive institutions even where no malware delivery is alleged. Separately, the United States Treasury has sanctioned participants in the Intellexa commercial spyware consortium, documenting a transnational corporate structure associated with the development and distribution of highly invasive surveillance technology. The Discover-Tech case therefore sits at the intersection of markets that have often been examined separately: legitimate advertising intermediation, commercial data brokerage, advertising-derived intelligence and offensive cyber exploitation. Their convergence may generate capabilities that are more consequential than those of any single component, because surveillance actors can potentially move from identifying a target to locating a reachable digital environment and finally attempting device compromise within a connected commercial workflow.

The national-security and economic implications

European institutions face a particularly complex challenge because the protection of personal data, the regulation of advertising markets, the enforcement of cybersecurity requirements and the investigation of state-linked espionage are distributed across partially overlapping jurisdictions and authorities. The European legal response cannot therefore be assessed through privacy law alone, just as the United Kingdom’s response cannot be understood exclusively through national-security institutions. The United Kingdom Information Commissioner’s Office had already identified transparency, lawful basis and security as fundamental concerns in real-time bidding during its 2019 regulatory examination, demonstrating that the underlying architectural weaknesses long preceded the October 2026 Discover-Tech disclosures. The principal development in 2026 is the stronger technical connection between those structural vulnerabilities and the documented delivery of mercenary spyware. An effective institutional response must consequently address both the distribution of advertising-derived personal information and the execution of third-party code through advertising channels, while ensuring that legitimate commercial intermediaries are not incorrectly equated with companies found to have participated in malicious surveillance. Summary Report of Adtech Fact Finding Forum — Information Commissioner’s Office — March 2019 .

Key Evidence Table — Discover-Tech and the AdFection Investigation

The following figures are separated according to their underlying units of measurement and evidentiary status, because combining bidding records, application counts, network exposure and confirmed device compromises would produce a misleading estimate of the operation’s actual reach.

Interpretation of the principal quantitative findings

The disclosed bidding records provide an unusually substantial empirical basis for assessing the magnitude of Discover-Tech’s advertising operations, although their importance should not be confused with a comprehensive accounting of every commercial relationship or operational campaign. Citizen Lab reports that the records came from two publicly accessible Apache Druid instances associated with Discover-Tech’s advertising infrastructure, and expressly states that those records did not include all activity conducted through other buying platforms, particularly Beeswax and Eskimi. The figures are therefore bounded by the collection architecture and the available dataset rather than constituting a certified global census of Discover-Tech’s operations.

A further distinction concerns the difference between the exchange participation percentages and the responsibility of the corresponding advertising companies. The presence of Yandex, Google Ad Manager or Vungle as an exchange value establishes the relevance of those systems to the advertising transactions examined; it does not demonstrate that the platform operator knew a spyware campaign, approved malicious code or intentionally facilitated an intelligence service. Such conclusions would require separate evidence concerning communications, knowledge, contractual arrangements, compliance warnings, incident responses and the timing of remedial actions.

The same caution applies to the frequently repeated estimate that hundreds of millions of people may have encountered Discover-Tech’s activities. That estimate, attributed by Reuters to Confiant cofounder Jérôme Dangu, is important as an assessment of possible reach, but the primary technical data reviewed here do not independently establish a deduplicated population of that size. The confirmed evidence is sufficiently serious without treating possible reach as a measured number of human targets.

The Worldwide Corporate Landscape — Initial Comparative OSINT Assessment

A rigorous global comparison requires distinguishing companies that have been technically connected to Discover-Tech from those whose products reproduce one or more of its capabilities, and from advertising intermediaries whose infrastructure may have been used without evidence that the intermediary participated knowingly in the underlying operation.

The appropriate analytical classification is therefore based on demonstrated technical function, documented legal entity, known relationships, source competence and strength of attribution, not on whether a company operates in Israel or markets products to intelligence and defence customers.

The Discover-Tech-specific relationships are drawn from Citizen Lab’s October 2026 report and Confiant’s technical investigation; the broader spyware and data-broker comparisons are supported by U.S. Treasury and Federal Trade Commission records. Exposing AdFection — Citizen Lab — October 2026 , Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium — U.S. Treasury — March 2024 , Gravy Analytics and Venntel Final Order — FTC — January 2025 and Mobilewalla Proceeding — FTC — January 2025 .

Why the international corporate distinction matters

The similarities between these companies are neither uniform nor necessarily evidence of a shared commercial or intelligence network. Candiru and comparable spyware vendors offer capabilities directed towards compromising devices and accessing information that conventional advertising technologies cannot ordinarily obtain. Advertising-intelligence specialists derive value from the ability to collect, correlate and analyse commercially available identifiers and associated behavioural information, which can be operationally significant without requiring exploitation of a software vulnerability. Location-data brokers specialise in obtaining or processing geographic observations and making them useful to commercial or institutional customers, while advertising exchanges provide the transactional infrastructure through which advertising inventory and associated data are distributed.

Discover-Tech’s distinctive significance, as presented by Citizen Lab, is that these activities were brought into proximity through an advertising-facing intermediary. Its operations allegedly allowed the broader commercial advertising system to perform functions associated with surveillance access, while specialised spyware systems remained capable of acting on selected devices. This creates a much more demanding investigative problem than merely identifying which company produced a particular exploit, because evidence of responsibility may be distributed across advertising accounts, software suppliers, intermediate domains, cloud services, corporate vehicles, contractual counterparties and end-customer organisations.

For corporate intelligence purposes, the relevant market should therefore be mapped through both vertical and horizontal relationships. Vertical analysis must follow the functional progression from advertising inventory and user identification to device-level access and subsequent information extraction; horizontal analysis must identify entities with common shareholders, directors, beneficial owners, technologies, personnel, distributors and customers. A credible global register will also distinguish historical corporate links from current ownership and technical interoperability from contractual cooperation. None of these relationships can be inferred from geographic proximity, nationality or similar product descriptions alone.

The Technical Relationship — How Commercial Advertising Can Become a Surveillance Channel

The relevant architecture contains five distinguishable functional stages.

ANALYTICAL DEPENDENCY MODEL — NON-OPERATIONAL OVERVIEW

Publisher website or mobile application

An advertising opportunity arises when a page or application requests commercial advertising content.

Advertising exchange and bidding infrastructure

Bid requests and associated signals may expose device, network, application and advertising-identifier information to participating parties.

Discover-Tech advertising intermediation

MyDSP and associated buying arrangements connect advertising opportunities with Discover-Tech-controlled delivery and targeting functions.

Controlium and selective response mechanisms

Advertiser-controlled scripts and device identifiers support profiling and the selection of devices for further processing.

Downstream surveillance and exploitation capability

Reconstructed from the functional relationships established in Citizen Lab’s technical investigation. The sequence is explanatory, not a claim that every advertising impression proceeds to spyware execution.

The second distinction concerns targeted selection. Advertising systems normally allow campaigns to distinguish among broad audiences based on commercial characteristics, but sufficiently detailed identifiers and auxiliary data can make it possible to focus on an individual device or a very small group of devices. Citizen Lab documents a Discover-Tech-controlled server arrangement that could return different responses depending on observed identifiers and other request characteristics. Such selectivity has two intelligence consequences: it permits concentration of expensive technical capabilities on selected targets, and it complicates detection because ordinary observers, automated advertising scanners and unrelated users need not receive the same code.

The third distinction concerns the relationship between running advertising code and compromising the device’s operating system. The ability to execute JavaScript in an advertising context does not automatically confer unrestricted access to personal messages, stored documents, microphones or protected application data. Those outcomes require additional weaknesses, exploit chains, permissions or other compromise mechanisms. The AdFection investigation is important precisely because it connects ordinary advertising delivery to a more specialised exploitation capability in documented cases, not because advertising scripts inherently possess the privileges of full spyware.

Competing Explanations and Intelligence Assessment

The present evidence supports examination of three competing, although partially overlapping, explanations of Discover-Tech’s role. The purpose is not to manufacture uncertainty the technical findings, but to distinguish what those findings establish from what would require access to internal financial, contractual or operational records.

The strongest current assessment concerns the technical and functional role of Discover-Tech, rather than the identity of every ultimate customer or governmental beneficiary. Its documented infrastructure supported surveillance-relevant collection and the delivery of malicious code associated with a mercenary spyware vendor, while the ownership, purchasing and operational arrangements of particular campaigns remain a distinct matter for investigation. Although governmental customers are relevant to the commercial spyware market, an analyst cannot identify the state responsible for a particular operation from a spyware company’s nationality, the geography of its targets or its known historical customers.

This limitation is especially important in the Al Jazeera case, because the presence of a strategically sensitive media organisation among the targets creates a substantial counterintelligence concern without independently identifying the contracting authority or political purpose behind the attacks. A defensible attribution would require converging evidence concerning command decisions, financing, customer access, operational timing and technical control, not merely an inference from regional political relationships.

Institutional Exposure — Initial International Assessment

United States: intelligence risk within commercial data markets

The American regulatory record provides some of the clearest official evidence that commercial data collection can present a significant national-security problem independently of the deployment of spyware. In its proceedings against Gravy Analytics and Venntel, the Federal Trade Commission examined the collection and sale of sensitive location information, including information associated with visits to medical facilities and places of worship, and finalised restrictions in January 2025. The Commission’s proceedings involving Mobilewalla and X-Mode/Outlogic further demonstrate that the governance of commercial location information is not an isolated issue involving a single provider.

These cases do not establish that the companies operated like Discover-Tech or supplied spyware. They establish something analytically different but closely related: sensitive intelligence can be derived from information generated for commercial purposes and distributed through ordinary business relationships. That observation has consequences for defence procurement, mobile-device policy and the governance of external advertising-data suppliers, particularly where organisations rely on contractual assurances that do not provide visibility into downstream transfers.

FTC Finalizes Order Prohibiting Gravy Analytics and Venntel from Selling Sensitive Location Data — Federal Trade Commission — January 2025 .

European Union: fragmented supervision of an integrated technical threat

The European challenge arises from the fact that an advertising transaction can involve a publisher in one jurisdiction, an exchange in another, a demand-side platform elsewhere and additional data recipients whose identity or eventual purpose is not necessarily apparent to the person concerned. The corresponding legal issues span the definition of personal data, the lawful basis for processing, purpose limitation, consent, security measures, responsibilities among controllers and processors, and potentially the criminal investigation of unauthorised computer access.

The Court of Justice of the European Union’s judgment of 7 March 2024 in Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit, provides an important legal foundation concerning consent-related data and controller responsibility in the advertising ecosystem. The legal relevance of the judgment must nevertheless be distinguished from the merits of the Discover-Tech allegations: it does not constitute a finding that Discover-Tech committed an infringement, nor does it automatically determine the responsibility of every advertising participant whose technology was used.

The strategic regulatory issue concerns the gap between compliance frameworks primarily designed to govern the processing of personal information and the additional cyber-espionage risk created when the same infrastructure allows downstream execution of selectively delivered code. Effective supervision must therefore be capable of examining both information disclosure and executable content, while preserving the differences between the legal obligations of publishers, exchanges, advertising purchasers and actors deploying spyware.

Judgment in Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit — Court of Justice of the European Union — March 2024 .

Italy, France, Germany and the United Kingdom: differentiated priorities

Italy should be examined through the exposure of public administration, diplomatic communications, defence-industrial organisations, strategic manufacturers, financial services and internationally connected technology suppliers. The central intelligence question is not whether Italian institutions appeared in a particular advertising dataset, something that cannot be generalised without supporting records, but whether existing security and procurement arrangements provide sufficient visibility over advertising software, external tracking dependencies, identity leakage and third-party code execution. The institutional assessment must ultimately reconcile the responsibilities of the national cybersecurity authorities, personal-data protection authorities and sector-specific supervisors.

France presents a particularly important regulatory comparison because the Commission nationale de l’informatique et des libertés has developed an enforcement record relating to personalised advertising and consent. In June 2023, the CNIL announced a €40 million sanction against Criteo concerning failures including verification of user consent. That case concerns advertising-data compliance, not spyware delivery, but demonstrates the ability of a national regulator to investigate the practices of a commercially significant advertising company. The French national-security inquiry should separately examine defence, government communications and strategic-industry exposure rather than interpreting privacy enforcement as evidence that those systems have been protected from offensive advertising-based operations.

Germany requires attention to the intersection of large industrial organisations, digitally integrated manufacturing, multinational supply chains and the distribution of privacy and cybersecurity responsibilities among European and domestic authorities. The strategic concern is the potential availability of behavioural and device-related information employees working across industrial and research environments, particularly where device usage is linked to internationally accessible advertising services. The relevant intelligence methodology should examine advertising dependencies and actual technical exposure before drawing conclusions particular German companies or facilities.

The United Kingdom offers a comparatively mature public record of regulatory concern regarding the structure of real-time bidding. Its Information Commissioner’s Office identified problems involving transparency, lawful processing and security years before the Discover-Tech disclosures, demonstrating that the underlying risks are not reducible to a newly discovered vulnerability. The 2026 case strengthens the argument that privacy and cybersecurity evaluations of advertising systems should be coordinated, with separate consideration of national-security consequences and the operational limitations of regulatory oversight.

The comparative European conclusion is that common advertising technologies can generate cross-border exposure even while the relevant national authorities retain different powers, investigative procedures and institutional priorities. Effective cooperation consequently depends on consistent technical definitions, common evidentiary standards and mechanisms for connecting advertising-platform incident information with national cybersecurity and intelligence responsibilities.

Principal Intelligence Gaps and Watch Indicators

The most important remaining questions concern attribution, financial relationships, the extent of technical compromise and the ability of advertising-industry countermeasures to interrupt comparable operations without simply displacing them to other platforms.

Five-year strategic outlook, 2026–2031

Three developments will be particularly important in determining whether the Discover-Tech case becomes a turning point in commercial surveillance regulation or remains one episode within a larger and insufficiently supervised market.

First, the continued commercial value of device identification and behavioural targeting creates incentives to maintain data flows that are useful to advertising and potentially valuable to intelligence operators. Even if a particular company’s accounts are terminated, those incentives remain unless the underlying conditions of data access, identifier exchange and executable advertising content change. Vendor exclusion should accordingly be evaluated as an immediate defensive action rather than presumed to eliminate the architectural vulnerability.

Second, the growing public record of official proceedings concerning location-data brokers and commercial spyware suppliers gives governments multiple existing intervention mechanisms, including data-protection enforcement, export controls, sanctions, cybersecurity regulation, procurement restrictions and criminal investigation. The effectiveness of these mechanisms will depend less on announcing additional prohibitions than on the capacity to identify operationally meaningful relationships among corporate entities, software infrastructure, intermediaries and end customers.

Third, the evolution of advertising platforms could move the risk in competing directions. Restrictions on cross-site identifiers, tighter validation of advertising code, greater transparency concerning recipients of bid information and improved isolation of advertising execution could reduce particular forms of surveillance exposure. Conversely, the emergence of substitute identification methods or new intermediaries could preserve meaningful intelligence collection even where traditional advertising identifiers become less accessible. A credible forecast therefore requires continuing observation of technical adoption, enforcement outcomes and newly documented incidents; the present record does not support precise probabilities for these competing pathways.

Initial Institutional Net Assessment

The October 2026 disclosures warrant treating advertising-derived intelligence and advertising-delivered exploitation as a connected strategic-security problem, but they do not justify categorising the entire global advertising industry as a malicious surveillance enterprise or assigning responsibility to companies solely because their infrastructure appears within a documented delivery chain.

The stronger analytical conclusion is that a market built to automate the identification, valuation and targeting of commercial audiences also provides technically valuable capabilities for intelligence collection. The Discover-Tech investigation establishes that those capabilities were combined, in documented circumstances, with infrastructure associated with mercenary spyware and with attacks against an internationally significant media organisation. The official American enforcement record concerning data brokers and spyware suppliers demonstrates that governments had already identified serious risks in adjacent markets before this disclosure; the new technical evidence makes the interaction between those markets more tangible and more consequential.

The highest-priority response is therefore an integrated institutional assessment of advertising-data exposure, third-party code execution, external vendor relationships and the intelligence value of the information disclosed by ordinary digital services. Such a response must be supported by verifiable evidence and legally competent authorities, while recognising that an institution may face meaningful counterintelligence exposure even without any confirmed successful device infection.

The subsequent chapters will develop the technical mechanisms, corporate ownership questions, worldwide company comparisons, financial relationships, jurisdictional implications and defensive options individually, with the distinction between established fact and analytical inference maintained throughout.

Four-month empirical baseline

Advertising operations in perspective

Recorded bids vs. apparent wins

Absolute scale, billions of bids. Heights a 0–4.0 billion axis.

Apparent winning rate: 11.7% . The smaller bar is a subset of the larger bar, not an independent category.

Percentage of recorded bids classified by the dataset’s exchange field; not revenue or market .

Published percentages total 99.46%; the residual is not allocated here. Source: Citizen Lab, Table 2.

of recorded bidding opportunities, split by app and browser environments.

This split measures bid volume, not unique device or user population.

Documented targeting is not the same as ad reach

Research documented infected devices using the sequence of advertising , Candiru validator and command-and-control connections; the “≥45” figure is a count of targeted devices, not a published census of all successful infections.

From an ordinary ad opportunity to selected exploitation

The following sequence shows functional dependencies documented in the investigation; most advertising events do not progress to malicious code delivery or infection.

A webpage or mobile application creates an advertising opportunity.

Advertising intermediaries circulate bid signals, potentially including device, network and identity-related data.

Discover-Tech purchased selected advertising impressions through several buying arrangements.

Advertiser-associated code could profile identifiers and selectively return additional code.

In documented cases, ads preceded Candiru validation and further exploitation, without ad clicks.

Not all participants perform the same role

Investigated advertising and surveillance-enabling infrastructure, including MyDSP and Controlium.

Spyware vendor linked by Citizen Lab to the Al Jazeera attack sequence.

Connections identified by Citizen Lab; distinct roles and participation require case-specific attribution.

Separate spyware ecosystem reflected in U.S. Treasury sanctions; no proven role in every AdFection campaign.

Data brokerage and location-intelligence cases documented by the FTC; no demonstrated Candiru delivery role.

Relevant advertising supply-chain systems. Use of a platform does not demonstrate knowing malicious participation.

Evidence table and attribution boundaries

Regulatory and institutional interpretation

Sources and interpretive controls

Exposing AdFection — Citizen Lab, University of Toronto, 15 October 2026 . Primary technical source for attack attribution, auction records, infrastructure and vendor responses. ADINT: Weaponized Ad Tech — Confiant, October 2026 . Complementary investigation of advertising payloads and surveillance mechanisms; investigations were co-timed, so not wholly independent for every claim.

U.S. Treasury — Sanctions on Intellexa, March 2024 ; FTC — Gravy Analytics and Venntel, January 2025 ; FTC — Mobilewalla matter ; CJEU — C-604/22, March 2024 ; UK ICO — Adtech Fact Finding Forum, 2019 .

The charts contain dataset measurements. The five-stage pathway is an explanatory synthesis based on observed technical mechanisms. The corporate cards group documented attack links, investigative associations, comparable commercial activities, and ordinary infrastructure intermediaries; membership in the last two groups is not an accusation of involvement in the attacks. No invented likelihoods, incident counts, ownership links or risk scores appear.

Primary technical investigations: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab, University of Toronto, 15 October 2026 and ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant, 15 October 2026 .

The four chapters examine the economic and historical architecture of advertising intelligence, reconstruct Discover-Tech’s corporate development and commercial relationships, distinguish the technical mechanisms through which advertising becomes an intelligence and exploitation channel, and assess the operational evidence concerning Candiru, Al Jazeera and geographically dispersed institutional exposure. The analysis distinguishes corporate registration evidence, platform documentation, observations made by cybersecurity researchers, formal institutional decisions and conclusions that remain dependent on reco...