AdTech used to deliver spyware

What's happened

Citizen Lab has published a report showing Israeli ad‑tech firm Discover‑Tech has sold targeted ads that routed millions of devices to mercenary spyware operators, including Candiru. Researchers have confirmed the technique has infected 45 Al Jazeera devices in 2024–25 and have shown Discover‑Tech ads reached government, military and critical‑infrastructure networks worldwide.

What's behind the headline?

What this actually means

• Discover‑Tech has weaponised programmatic advertising to identify, track and route targeted devices to mercenary spyware. The firm’s Controlium platform has been used as a bridge between ad exchanges and spyware vendors such as Candiru and Bindecy.

Technical escalation

• This is the first confirmed instance where zero‑click spyware has been delivered through targeted ads. Unlike phishing, the malicious payload executes when an ad loads; users do not have to click or download anything. That turns routine web traffic into an attack surface that is effectively universal.

Scale and exposure

• Citizen Lab recovered billions of bidding records showing Discover‑Tech ad impressions across tens of thousands of apps and sites. Those impressions appeared on networks belonging to NATO, the UN, the European Commission, the Pentagon and numerous critical‑infrastructure and media organisations. Even if not every ad led to a compromise, the routing alone gives operators reconnaissance and targeting ability on an industrial scale.

Who benefits and who is at risk

• Mercenary spyware vendors will gain from cheaper, more precise distribution channels. States or actors that buy those services will gain the ability to perform clandestine surveillance across boundaries without deploying traditional intercept infrastructure. Journalists, diplomats, military staff and technical operators will suffer the greatest immediate risk.

Systemic failure and likely responses

• Major ad platforms have already started removing Discover‑Tech from their registries and exchanges. That will reduce the firm’s reach short term, but the underlying vulnerability is structural: real‑time bidding exposes device identifiers and metadata to many intermediaries. Regulators will be forced to act; expect pressure for stricter verification of vendors, mandated vendor audits, and technical changes to how bid requests expose identifiers.

What will happen next

• Ad exchanges will tighten vetting and revoke access for suspicious brokers. Lawmakers and cyber‑security agencies will open investigations and impose sanctions or fines. Operators of mercenary spyware will shift to covert or bespoke channels, which will drive further escalation in offensive and defensive cyber tools.

Practical consequence for organisations and individuals

• Organisations that handle sensitive information will need to block or severely restrict ad traffic on work devices, segment networks, and enforce stronger endpoint monitoring. Individuals in sensitive roles will need to disable ad tracking, use hardened devices, and treat normal browsing as a potential reconnaissance vector.

How we got here

Programmatic ad exchanges allow advertisers to bid to show ads to specific devices. Citizen Lab and Confiant have shown that an ad broker called Discover‑Tech used that system to deanonymise targets and route devices to spyware control servers, enabling zero‑click infections without user interaction.

Our analysis

Citizen Lab (University of Toronto) provides the technical core of the story: its report documents the Controlium platform, exposed authentication logs, and more than four billion ad bidding records that link Discover‑Tech to targeted routing of devices to spyware control servers. Citizen Lab writes that the campaign infected 45 Al Jazeera devices in 2024–25 and that the approach represents a new delivery technique for zero‑click spyware. Al Jazeera has confirmed that unusual patterns on staff devices prompted the investigation and that it has shared logs with Citizen Lab. Confiant (reported via Reuters and other outlets) supplies corroborating evidence about the volume and reach of Discover‑Tech ads and details on impressions seen in sensitive networks; Confiant’s cofounder Jerome Dangu is quoted saying Discover‑Tech pumped at least 10 million ads per day. Major outlets emphasise platform responses: Ars Technica, The Guardian and The Times of Israel note that Google and industry groups have removed Discover‑Tech from vendor registries and that several ad platforms have suspended its access. The Times of Israel and Reuters cite Confiant’s finding that Discover‑Tech impressions reached government and critical infrastructure networks, and they report that some companies named Discover‑Tech as a certified vendor before the investigations. TechCrunch and Al Jazeera via Ads, Report Says" target="_blank">Bloomberg highlight the link to Candiru (also referenced as Integrity Labs) and note Candiru’s prior US blacklist in 2021. Across the coverage, direct language is consistent: Citizen Lab says Discover‑Tech acted as a “bridge between ad vendors and the mercenary spyware ecosystem,” while researchers warn that the online advertising ecosystem is a systemic security threat that has exposed governments, media and civil society to industrial‑scale surveillance.

Go deeper

• Which ad platforms still allow Discover‑Tech to buy inventory and what measures are they taking?
• How will regulators change rules for real‑time bidding and vendor verification?
• What immediate steps should newsrooms and governments take to protect devices?

More on these topics

• Al-Jazeera - Media company

  Al Jazeera is an international Arabic news channel based in Doha, Qatar that is operated by the media conglomerate Al Jazeera Media Network.

• Citizen Lab - Software developer

  The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs at the University of Toronto, Canada.

• Candiru - Fish

  Candiru, also known as cañero, toothpick fish, or vampire fish, is a species of parasitic freshwater catfish in the family Trichomycteridae native to the Amazon Basin where it is found in the countries of Bolivia, Brazil, Colombia, Ecuador, and Peru.

• Google - Technology company

  Google LLC is an American multinational technology company that specializes in Internet-related services and products, which include online advertising technologies, a search engine, cloud computing, software, and hardware.

• United Nations - Intergovernmental organization

  The United Nations is an intergovernmental organization that aims to maintain international peace and security, develop friendly relations among nations, achieve international cooperation, and be a centre for harmonizing the actions of nations.

• NATO

  The North Atlantic Treaty Organization, also called the North Atlantic Alliance, is an intergovernmental military alliance between 30 North American and European countries.

• International Criminal Court - Intergovernmental organization

  The International Criminal Court is an intergovernmental organization and international tribunal that sits in The Hague, Netherlands.

• Israel - Country in the Middle East

  Israel, formally known as the State of Israel, is a country in Western Asia, located on the southeastern shore of the Mediterranean Sea and the northern shore of the Red Sea.

• University of Toronto - Public research university in the Greater Toronto Area of Ontario, Canada

  The University of Toronto (U of T) is a public research university with three main campuses in the Greater Toronto Area of Ontario, Canada. Based on the grounds that surround Queen's Park in Toronto, it was founded by royal charter in 1827 as King's College, the first institution of higher learning in Upper Canada. Originally controlled by the Church of England, the university assumed its present name in 1850 upon becoming a secular institution. The university's three campuses are known as St. George, Mississauga, and Scarborough. Its large downtown Toronto location, St. George, is the oldest of the three and comprises 11 colleges, each with varying autonomy over financial and institutional affairs and significant differences in character and history. Its suburban campuses in the Toronto district of Scarborough to the east and city of Mississauga to the west were established in the 1960s, and together make up nearly half of the university's undergraduate student body. The University of Toronto is the largest post-secondary institution in Canada, with more than 100,000 students enrolled and over 720,000 alumni. It offers over 700 undergraduate and 200 graduate programs. The university...

• Yandex - Internet services company

• Nvidia - Computer game company

  Nvidia Corporation is an American multinational technology company incorporated in Delaware and based in Santa Clara, California.

• Qatar - Country in the Middle East

  Qatar, officially the State of Qatar, is a country located in Western Asia, occupying the small Qatar Peninsula on the northeastern coast of the Arabian Peninsula.

• Al Jazeera Media Network - Qatari international news public broadcaster

  Al Jazeera Media Network (AJMN) is a Qatari news media organization headquartered in Wadi Al Sail, Doha. It is a statutory private foundation for public benefit, and is primarily funded by the government of Qatar. The network's flagship channels include..

• Europe - Region in Europe

  Central Europe is the region comprising the central part of Europe. Central Europe occupies continuous territories that are otherwise sometimes considered parts of Western Europe, Southern Europe and Eastern Europe.

• Reuters - News organization company

  Reuters is an international news organization owned by Thomson Reuters. It employs some 2,500 journalists and 600 photojournalists in about 200 locations worldwide. The agency was established in London in 1851 by the German-born Paul Reuter.

• Micron Technology - American multinational corporation based in Boise, Idaho

  Micron Technology, Inc. is an American multinational semiconductor company that manufactures computer memory and computer data storage products, including dynamic random-access memory (DRAM), flash memory, High Bandwidth Memory (HBM), and solid-state drives (SSDs). Founded in 1978 in Boise, Idaho, Micron is the only major American computer memory manufacturer. It is one of the "Big Three" computer memory manufacturers, along with the South Korean companies Samsung Electronics and SK Hynix. Micron marketed its consumer products under the brand Crucial, with the sub-brand Ballistix being used to denote products targeting gaming computers, until its disestablishment on 2026. Micron and Intel together created IM Flash Technologies, which produced NAND flash memory. It owned Lexar between 2006 and 2017. Sanjay Mehrotra has served as president and CEO of Micron since 2017. On May 26, 2026, Micron became the latest U.S. company to reach a US$1 trillion market capitalization, amid surging demand for its HBM chips.

• Broadcom - American semiconductor company

  Broadcom Inc. is an American multinational designer, developer, manufacturer, and global supplier of a wide range of semiconductor and infrastructure software products. Broadcom's product offerings serve the data center, networking, software, broadband...

• European Commission - Governing body of protected sites

  The European Commission is the executive branch of the European Union, responsible for proposing legislation, implementing decisions, upholding the EU treaties and managing the day-to-day business of the EU.

• European Parliament

  The European Parliament is one of three legislative branches of the European Union and one of its seven institutions. Together with the Council of the European Union, it adopts European legislation, normally on a proposal from the European Commission.

• Mexico - Country in North America

  Mexico, officially the United Mexican States, is a country in the southern portion of North America. It is bordered to the north by the United States; to the south and west by the Pacific Ocean; to the southeast by Guatemala, Belize, and the Caribbean Sea

• SanDisk - Manufacturing company

  SanDisk is a brand of Western Digital for flash memory products, including memory cards and readers, USB flash drives, and solid-state drives. It was acquired by Western Digital in 2016.

• Comcast - Telecommunications company

  Comcast Corporation is an American telecommunications conglomerate headquartered in Philadelphia, Pennsylvania. It is the second-largest broadcasting and cable television company in the world by revenue and the largest pay-TV company, the largest cable TV