Ads Delivered State-Grade Spyware

What's happened

Researchers have published evidence that Israeli ad firm Discover-Tech has sold programmatic ad placements that directed millions of devices to spyware operators, including Candiru. Citizen Lab and Confiant have shown adverts reached hundreds of thousands of sites and apps and were used to identify, track and in some cases infect devices, including at Al Jazeera between 2024 and 2025.

What's behind the headline?

The mechanism: advertising as a delivery channel

Discover-Tech has presented Controlium as an ad-tech product that participates in real-time bidding. Citizen Lab and Confiant have reproduced how an ad impression can carry identification metadata and then redirect selected devices to servers controlled by spyware vendors. That turns programmatic advertising from a marketing tool into a mass reconnaissance and targeting platform.

Scale and reach

The forensic traces show Discover-Tech’s ads ran across tens of thousands of sites and apps and generated billions of bidding records. Confiant estimated Discover-Tech pumped at least 10 million ads a day; Citizen Lab found ad placements on nearly 200,000 domains and apps. This scale means the technique will likely have touched hundreds of millions of devices even if only a fraction were actively targeted for infection.

Zero-click infections raise stakes

The spyware implicated — notably Candiru — can install without user interaction. Where an ad loads, the payload can run. Citizen Lab has connected such an ad-delivered payload to compromises of 45 Windows machines at Al Jazeera in 2024–25. That confirms programmatic ads can move from profiling to active compromise of high-value targets.

Consequences for institutions and vendors

Major ad platforms are now removing Discover-Tech from their inventories. Google has said it has kicked Discover-Tech off its systems. That response will reduce immediate exposure, but it will not remove the structural weakness: automated auctions distribute rich device and identity signals through many intermediaries. Regulators and platform operators will need to force architectural changes to bidding flows or risk further abuse.

Likely next steps

• Platforms will increase vetting and suspension of intermediaries that expose bidding records or credentials.\
• Governments will press for logging, provenance and minimum-security requirements for participants in ad auctions.\
• Commercial spyware firms will look for alternate conduits; the technique will migrate until the market hardens.

What individuals and organisations should do now

• Organisations that handle sensitive information will need to block untrusted ad networks at network edge and consider disabling ad rendering on managed devices.\
• Security teams should hunt for unusual DNS and redirect patterns associated with ad bidding and check historical logs for connections to known Candiru infrastructure.

This episode will force the ad industry and regulators to treat programmatic ad ecosystems as an active attack surface rather than a purely commercial market. Remediating that surface will require technical controls, greater transparency and regulatory pressure; otherwise mercenary spyware will keep exploiting the same plumbing.

How we got here

Online ad auctions route billions of ad impressions through intermediaries that profile users in real time. Citizen Lab has investigated Controlium, Discover-Tech's ad platform, and found exposed logs and bidding records that show ads reaching government, media and corporate networks and linking to mercenary spyware operators.

Our analysis

Citizen Lab has published the central technical report linking Discover-Tech’s Controlium platform to ad-delivered spyware and to compromises at Al Jazeera. The Times of Israel summarised Citizen Lab and Confiant’s findings, quoting Wolfie Cristl of Citizen Lab: "The way online advertising works today is a systemic security threat." Confiant cofounder Jerome Dangu told Reuters and other outlets that Discover-Tech was serving at least 10 million ads per day and that "very likely hundreds of millions of people would have been touched by Discover-Tech." Al Jazeera has said it "condemns the targeting of devices belonging to several of its employees with spyware" and credited its internal logs for enabling Citizen Lab’s timeline. TechCrunch and Al Jazeera via Ads, Report Says" target="_blank">Bloomberg reproduce Citizen Lab’s technical claims, with TechCrunch noting that researchers recovered exposed Controlium source material and login records tying users from Candiru and Bindecy to the platform. Politico and The Guardian emphasise the programmatic-bidding vector and list institutional sites where the ads appeared, including NATO, the UN and EU institutions. Google has told reporters it has removed Discover-Tech from its ad platforms "for systematically violating our policies," reflecting platform-level remediation following the disclosures.

Go deeper

• How did researchers confirm the link between specific ads and spyware infections at Al Jazeera?
• What immediate network mitigations can organisations run to detect ad-delivered compromises?
• Will regulators force structural changes to real-time bidding systems, and on what timetable?

More on these topics

• Al-Jazeera - Media company

  Al Jazeera is an international Arabic news channel based in Doha, Qatar that is operated by the media conglomerate Al Jazeera Media Network.

• Citizen Lab - Software developer

  The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs at the University of Toronto, Canada.

• Candiru - Fish

  Candiru, also known as cañero, toothpick fish, or vampire fish, is a species of parasitic freshwater catfish in the family Trichomycteridae native to the Amazon Basin where it is found in the countries of Bolivia, Brazil, Colombia, Ecuador, and Peru.

• International Criminal Court - Intergovernmental organization

  The International Criminal Court is an intergovernmental organization and international tribunal that sits in The Hague, Netherlands.

• University of Toronto - Public research university in the Greater Toronto Area of Ontario, Canada

  The University of Toronto (U of T) is a public research university with three main campuses in the Greater Toronto Area of Ontario, Canada. Based on the grounds that surround Queen's Park in Toronto, it was founded by royal charter in 1827 as King's College, the first institution of higher learning in Upper Canada. Originally controlled by the Church of England, the university assumed its present name in 1850 upon becoming a secular institution. The university's three campuses are known as St. George, Mississauga, and Scarborough. Its large downtown Toronto location, St. George, is the oldest of the three and comprises 11 colleges, each with varying autonomy over financial and institutional affairs and significant differences in character and history. Its suburban campuses in the Toronto district of Scarborough to the east and city of Mississauga to the west were established in the 1960s, and together make up nearly half of the university's undergraduate student body. The University of Toronto is the largest post-secondary institution in Canada, with more than 100,000 students enrolled and over 720,000 alumni. It offers over 700 undergraduate and 200 graduate programs. The university...

• Google - Technology company

  Google LLC is an American multinational technology company that specializes in Internet-related services and products, which include online advertising technologies, a search engine, cloud computing, software, and hardware.

• Israel - Country in the Middle East

  Israel, formally known as the State of Israel, is a country in Western Asia, located on the southeastern shore of the Mediterranean Sea and the northern shore of the Red Sea.

• NATO

  The North Atlantic Treaty Organization, also called the North Atlantic Alliance, is an intergovernmental military alliance between 30 North American and European countries.

• United Nations - Intergovernmental organization

  The United Nations is an intergovernmental organization that aims to maintain international peace and security, develop friendly relations among nations, achieve international cooperation, and be a centre for harmonizing the actions of nations.

• Yandex - Internet services company

• Nvidia - Computer game company

  Nvidia Corporation is an American multinational technology company incorporated in Delaware and based in Santa Clara, California.

• Al Jazeera Media Network - Qatari international news public broadcaster

  Al Jazeera Media Network (AJMN) is a Qatari news media organization headquartered in Wadi Al Sail, Doha. It is a statutory private foundation for public benefit, and is primarily funded by the government of Qatar. The network's flagship channels include..

• Qatar - Country in the Middle East

  Qatar, officially the State of Qatar, is a country located in Western Asia, occupying the small Qatar Peninsula on the northeastern coast of the Arabian Peninsula.

• Mexico - Country in North America

  Mexico, officially the United Mexican States, is a country in the southern portion of North America. It is bordered to the north by the United States; to the south and west by the Pacific Ocean; to the southeast by Guatemala, Belize, and the Caribbean Sea

• Europe - Region in Europe

  Central Europe is the region comprising the central part of Europe. Central Europe occupies continuous territories that are otherwise sometimes considered parts of Western Europe, Southern Europe and Eastern Europe.

• Reuters - News organization company

  Reuters is an international news organization owned by Thomson Reuters. It employs some 2,500 journalists and 600 photojournalists in about 200 locations worldwide. The agency was established in London in 1851 by the German-born Paul Reuter.

• Comcast - Telecommunications company

  Comcast Corporation is an American telecommunications conglomerate headquartered in Philadelphia, Pennsylvania. It is the second-largest broadcasting and cable television company in the world by revenue and the largest pay-TV company, the largest cable TV

• Micron Technology - American multinational corporation based in Boise, Idaho

  Micron Technology, Inc. is an American multinational semiconductor company that manufactures computer memory and computer data storage products, including dynamic random-access memory (DRAM), flash memory, High Bandwidth Memory (HBM), and solid-state drives (SSDs). Founded in 1978 in Boise, Idaho, Micron is the only major American computer memory manufacturer. It is one of the "Big Three" computer memory manufacturers, along with the South Korean companies Samsung Electronics and SK Hynix. Micron marketed its consumer products under the brand Crucial, with the sub-brand Ballistix being used to denote products targeting gaming computers, until its disestablishment on 2026. Micron and Intel together created IM Flash Technologies, which produced NAND flash memory. It owned Lexar between 2006 and 2017. Sanjay Mehrotra has served as president and CEO of Micron since 2017. On May 26, 2026, Micron became the latest U.S. company to reach a US$1 trillion market capitalization, amid surging demand for its HBM chips.

• Broadcom - American semiconductor company

  Broadcom Inc. is an American multinational designer, developer, manufacturer, and global supplier of a wide range of semiconductor and infrastructure software products. Broadcom's product offerings serve the data center, networking, software, broadband...

• European Commission - Governing body of protected sites

  The European Commission is the executive branch of the European Union, responsible for proposing legislation, implementing decisions, upholding the EU treaties and managing the day-to-day business of the EU.

• SanDisk - Manufacturing company

  SanDisk is a brand of Western Digital for flash memory products, including memory cards and readers, USB flash drives, and solid-state drives. It was acquired by Western Digital in 2016.