Researchers link Israeli ad firm to zero-click spyware attacks

Researchers at the Citizen Lab have identified a new method for delivering mercenary spyware, linking Israeli advertising technology firm Discover-Tech to zero-click attacks against devices at the international news network Al Jazeera. The report, published on October 15, 2026, describes a technique the researchers call "AdFection," where targeted advertisements serve as a pipeline for installing spyware without user interaction.

The AdFection Technique

According to the Citizen Lab, Discover-Tech operates a platform called Controlium, which allows clients to de-anonymize and fingerprint internet users. When a targeted user is shown an ad, the ad’s code can automatically execute JavaScript that installs spyware. This process requires no click or interaction from the victim, distinguishing it from traditional phishing or malware delivery methods.

"[The online advertising] ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says.

The researchers state that at least 45 devices within Al Jazeera were targeted in attacks during 2024 and 2025. The spyware used in these instances is attributed to Candiru, a mercenary surveillance vendor that has rebranded as "Integrity Labs." The attack sequence involves the device first contacting Discover-Tech infrastructure, followed by a connection to a Candiru validator server, and finally establishing communication with a Command and Control (C&C) server.

Scale and Industry Response

Analysis of four billion Discover-Tech bidding records revealed that the company’s ads were displayed on nearly 200,000 unique websites and apps across dozens of countries. The report notes that Discover-Tech appeared on lists of "certified" and "approved" vendors maintained by Google and the advertising industry association IAB Europe until early October 2026.

Following the disclosure of these findings, several major ad vendors took action. Google terminated Discover-Tech’s access to its ad exchange platforms, and IAB Europe removed the company from its registries. Beeswax removed Discover-Tech from its ad buying platform, while Vungle (Liftoff) paused access pending a review. Eskimi blocked the company’s accounts and domains.

Wolfie Christl, a researcher at Citizen Lab, stated, "It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years."

Links to Other Surveillance Vendors

The investigation also uncovered connections between Discover-Tech and other mercenary surveillance entities, including Intelos and Bindecy. Intelos is described as a mercenary advertising intelligence (ADINT) firm, while Bindecy is identified as a mercenary hacking company. Additionally, the researchers identified a separate threat actor, referred to as DARK CARTOGRAPHER, which uses Discover-Tech’s infrastructure to link device advertising IDs with phone numbers, a process that mass-deanonymizes internet users.

Bill Marczak, a researcher at Citizen Lab, noted the significance of the findings: "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action."

Why it matters

The report highlights structural vulnerabilities in the real-time bidding (RTB) system used for online advertising. Because ads can contain executable code, malicious actors can exploit the ecosystem to target specific individuals with high precision. The failure of major ad vendors and industry bodies to detect these operations for years raises concerns about the security of the digital advertising infrastructure for states, private sectors, and civil society. Citizen Lab has called on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws.

---

Sources

• citizenlab.ca: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
• theguardian.com: Online ads weaponised to deliver ‘zero-click’ spyware, researchers say | Hacking | The Guardian

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.