Citizen Lab Ties Discover-Tech Ad Network to Candiru Spyware

Citizen Lab analyzed 4 billion Discover-Tech bidding records from exposed servers; malicious ads reached 75,373 apps and 120,768 websites across 161 countries.

The NOAS server returned exploit JavaScript only to IP-matched targets, sending a 0-byte response to all others, making the payload invisible to ad platform scanners.

Candiru, Commerce-blacklisted in 2021, continued operating as Integrity Labs through Discover-Tech, confirming entity-level export controls do not neutralize commercial spyware vendors.

A powerful form of Candiru spyware was pushed through an Israeli ad agency's network to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, WIRED reported , citing Citizen Lab and ad-fraud firm Confiant.

The agency, Discover-Tech, was pumping out at least 10 million ads a day across more than 120,000 websites and 75,000 apps, the researchers said. The malicious inventory landed on "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Ads only had to load on a page for tracking to kick in; in some cases, Discover-Tech also attempted to extract phone numbers from smartphone users.

The spyware payloads were a small of overall volume, but moved through the same plumbing: a legitimate-looking vendor plugged into the global programmatic market, able to narrow in on individuals through the same demographic and location filters any advertiser uses.

Candiru is not a new name on the sanctions map. The US Commerce Department blacklisted the firm in 2021 for allegedly supplying spyware used to target government officials, journalists, activists and academics. What is new, in the researchers' telling, is the conduit itself — ad exchanges, rather than phishing links or messaging-app zero-days.

Platforms moved quickly on the findings. Google removed Discover-Tech from its ad platforms for "systematically violating its policies," Forbes reported . IAB Europe said it suspended the firm from its global vendor list following a policy audit. Comcast's ad-tech subsidiary Beeswax also cut ties. The story sits inside a run of surveillance reporting we've been tracking over the past 90 days, but the delivery channel here is the distinguishing detail.

What others are reporting

Coverage cluster as of 8h after publish

Citizen Lab Read → Primary research: reverse-engineered Controlium frontend linked specific state targets to Candiru chains via an unauthenticated API leaking 128 days of platform login logs. This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.

Primary research: reverse-engineered Controlium frontend linked specific state targets to Candiru chains via an unauthenticated API leaking 128 days of platform login logs.

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.

TechCrunch Read → Exposed source code and login records let researchers reconstruct Discover-Tech's control panel and map billions of bidding records, adding granular technical detail on the discovery method. Now for the first time, we have concrete technical evidence showing this process in action. — Bill Marczak, Citizen Lab

Exposed source code and login records let researchers reconstruct Discover-Tech's control panel and map billions of bidding records, adding granular technical detail on the discovery method.

Now for the first time, we have concrete technical evidence showing this process in action. — Bill Marczak, Citizen Lab

CyberScoop Read → Documents Google and IAB Europe removing Discover-Tech from vendor lists after disclosure; reports DARK CARTOGRAPHER's documented tie to a U.S. government contractor. Digital advertising is broken...Cybersecurity agencies, regulators and lawmakers must urgently step in.

Documents Google and IAB Europe removing Discover-Tech from vendor lists after disclosure; reports DARK CARTOGRAPHER's documented tie to a U.S. government contractor.

Digital advertising is broken...Cybersecurity agencies, regulators and lawmakers must urgently step in.

GBHackers Read → Network-flow detail on the full exploit chain from device to NOAS server to Candiru validator to C&C, with hardcoded IoCs from the recovered Windows DLL and defensive guidance for journalists. Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads.

Network-flow detail on the full exploit chain from device to NOAS server to Candiru validator to C&C, with hardcoded IoCs from the recovered Windows DLL and defensive guidance for journalists.

Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads.

Shared on Bluesky by 2 AI experts

Marielza @marielza.bsky.social amplified Andrew Couts @couts.bsky.social NEW: Researchers at @citizenlab.ca found ~45 phones belonging to @aljazeera.com infected with zero-click spyware that was distributed via online ads—a “nightmare scenario” that is extremely difficult to defend against. @… View on Bluesky →

Andrew Couts @couts.bsky.social

NEW: Researchers at @citizenlab.ca found ~45 phones belonging to @aljazeera.com infected with zero-click spyware that was distributed via online ads—a “nightmare scenario” that is extremely difficult to defend against. @…

Andrew Couts @couts.bsky.social : NEW: Researchers at @citizenlab.ca found ~45 phones belonging to @aljazeera.com infected with zero-click spyware that was distributed via on… →

Originally reported by wired.com

Original headline: Citizen Lab Exposes Israeli Ad Firm Discover-Tech Routing Al Jazeera and UN Targets to Candiru Spyware