The ad was the exploit

The Citizen Lab at the University of Toronto said on Thursday that an Israel-based advertising company, Discover-Tech, ran a platform that let spyware makers infect devices through targeted online ads, and that at least 45 devices at the news network Al Jazeera were targeted in 2024 and 2025 with spyware from Candiru, which now trades as Integrity Labs. "This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads," says the report, titled "Exposing AdFection".

According to the report, Discover-Tech presents itself as a legitimate ad company but "appears to be a front for large-scale ad espionage abuse". Its platform, Controlium, lets partners de-anonymise and fingerprint devices and infect them the moment an ad renders, with no click needed. Citizen Lab links the Al Jazeera attacks to Candiru with what it calls high confidence, based on network analysis, infrastructure fingerprints and similarities with Candiru malware it captured in 2021. It also ties a second spyware maker, Bindecy, to Controlium through login records and server fingerprints. Discover-Tech had published the full source code of Controlium's front end on its login page, which let the researchers rebuild its interface.

The researchers worked from exposed ad-bidding data: nearly four billion bidding records that the report says sat publicly on a Discover-Tech server. For its MyDSP platform, between March and June 2026, the records show about 3.77bn bids, about 442m of them won (11.7 per cent), and spending of about $109,091. At least 718,748,885 bids, about 19 per cent, were for ads carrying attacker script tags, and those ads were displayed in 75,373 apps and on 120,768 websites, close to 200,000 in all by our arithmetic.

The report is careful about what the numbers do not show. "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware," it says. The data covers one platform and four months, and IP geolocation can be wrong because of VPNs and satellite links. Citizen Lab says it would be easy to spoof a valid Controlium access token but that it did not try, because doing so would have been unauthorised access. It found no evidence of a business relationship between Discover-Tech and AliExpress, whose name appeared on many of the ads, and thinks those ads were probably not bought on AliExpress's behalf.

The exposure of sensitive networks is therefore a matter of risk, not proof of infection. The report cites a companion investigation by the ad-security firm Confiant, which found signs that the ads were displayed on networks of the US Department of Defense, the Dutch Ministry of Economic Affairs, Estonia's Information System Authority, Spain's digital transformation ministry, the office of Armenia's prime minister and several Israeli government bodies, and also on networks of the International Atomic Energy Agency and the International Criminal Court.

Bill Marczak, a senior researcher at Citizen Lab, told TechCrunch that Discover-Tech is "surely just the tip of the iceberg" and that "now for the first time, we have concrete technical evidence showing this process in action." His advice to people who may be targeted because of who they are or what they do: "it's time to disable ad tracking on your devices or even block ads altogether." Al Jazeera and Discover-Tech did not respond to TechCrunch, and Integrity Labs could not be reached. Citizen Lab says Discover-Tech, Candiru and Bindecy did not respond to its own requests for comment.

Parts of the ad industry have already acted. According to the report, Google and IAB Europe removed Discover-Tech from their vendor registries in early October and Google cut its access to its ad exchanges; Beeswax removed it, Vungle (Liftoff) paused its access pending a review, and Eskimi also acted against it. Citizen Lab calls on regulators to investigate whether Discover-Tech and Candiru broke the law. It says a separate actor using Discover-Tech's infrastructure, which it calls DARK CARTOGRAPHER, will be the subject of a later report.

The finding moves the spyware attack surface from the individual device to the bidding market. A zero-click attack that arrives as an ordinary ad cannot be avoided by declining to open a message, and the defences the researchers point to, blocking ads or limiting ad tracking, are not ones most organisations enforce. The evidence concerns one firm and one period; Marczak's own warning is that it is unlikely to be the only one.

Komposite has tracked how attackers reach phones, including an exploited flaw fixed only for the phones that did not upgrade. The Citizen Lab report describes a different route, in which the delivery channel is the advertising system itself, and the companies in the middle are only now being asked what they knew.