Discover-Tech's Controlium platform could target a phone by advertising ID, cookie or IP, then fire spyware the moment the ad loaded. Citizen Lab says the Israeli firm has run the scheme, called AdFection, for years.
No tap, no link, no download. On October 15, Citizen Lab, the University of Toronto research group, published a report naming Israeli ad-tech firm Discover-Tech as the operator behind a spyware delivery scheme the researchers call AdFection. The firm's ad platform, Controlium, let clients pick a target by advertising ID, browser cookie or IP address and push attack code to that device the instant a real ad rendered on screen. The ad just had to load.
That is the detail that separates this case from the usual spyware story. Pegasus and its rivals have spent years refining the single-target exploit: a text message, a missed call, a malicious link sent to one phone. AdFection skips the targeting problem entirely by hijacking a system built to solve it at scale already, the real-time bidding infrastructure that places billions of ads a day based on exactly the kind of device fingerprinting Controlium needed.
According to Citizen Lab, working with the ad-fraud research firm Confiant, Discover-Tech's network served more than 10 million ads a day across upwards of 120,000 websites and 75,000 apps, reaching devices in 161 countries. Each ad silently phoned a Discover-Tech server with the device's ad identifier. If that identifier matched a flagged target, the server pushed back code built to deanonymize and fingerprint the device, and in the confirmed cases, deliver spyware attributed to Candiru, the Israeli firm the U.S. Commerce Department blacklisted in 2021 for supplying tools used against journalists, activists and officials.
The clearest victim is Al Jazeera. Citizen Lab and Confiant found at least 45 Windows devices tied to the network that had been actively compromised between 2024 and 2025, the first publicly documented confirmation of ad-delivered spyware reaching real machines rather than just a lab proof of concept. Al Jazeera itself has reported on the findings, noting the devices belonged to its staff.
Reach is a different question from infection, and the report is careful that distinction. Malicious ads carrying Discover-Tech's tracking code rendered on networks belonging to the U.S. Department of Defense, the International Atomic Energy Agency and the International Criminal Court, along with Estonia's Information System Authority. In Norway, the ads reached the parliament and police networks; in Sweden, the armed forces and the national grid operator. Citizen Lab did not confirm those institutions were actually infected, only that the ad network's reach extended into them, which on its own says something how little visibility these organizations have into what their own networks are loading.
That gap, between reach and confirmed compromise, is the part most likely to get flattened in the retelling. It shouldn't be. A banner ad landing on a Pentagon-connected device is not nothing, but it is a different claim than a banner ad handing over control of that device.
The industry's response has been fast, for once
Within days of the report, Google removed Discover-Tech from its ad platforms, citing systematic policy violations. IAB Europe, the trade body that maintains a vendor list used across the European ad ecosystem, suspended the firm after its own audit turned up the same violations. Comcast's ad-tech subsidiary Beeswax dropped Discover-Tech from its platform as well, citing recent activity.
Three cutoffs in under a week is fast by ad-tech standards, where bad actors often linger in vendor lists for months because nobody audits the audit. But cutting one firm out of the pipe doesn't fix the pipe. The entire premise of programmatic advertising is that a stranger's software gets a brief window to run code-adjacent decisions on your device based on a profile it assembled you from an ad identifier, a cookie, an IP address. Discover-Tech didn't need to break that system. It used it as designed, then layered a nation-state-grade payload on top.
Frankly, that's the uncomfortable part of this story. Candiru needed a way to find and hit a specific phone or laptop without the target clicking anything, and the open ad exchange handed it one, already built, already running at a scale no single spyware vendor could match on its own. The 2021 Commerce Department blacklist didn't touch Candiru's access to that pipe at all, because the pipe belongs to an entirely different industry that nobody was watching for this.
Discover-Tech has not issued a public response to the Citizen Lab findings as of this writing. Candiru, which rarely on reporting its tools, has not either.
Also read: DeepSeek quietly pushed a new model update straight into its live API • Citi says Hong Kong's AI chip IPOs are shrugging off the US selloff • Stripe Reportedly Agrees to Buy AI Router OpenRouter for Over $7 Billion
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
