Researchers at the University of Toronto’s Citizen Lab revealed on October 15, 2026, that an Israeli digital advertising agency named Discover-Tech weaponized programmatic online ads to silently deploy zero-click mercenary spyware from Candiru onto devices at Al Jazeera and international institutions.
How Discover-Tech Turned Routine Online Ads Into an Attack Pipeline
Online advertisements for everyday items like phones and earbuds served as the delivery mechanism for what researchers have dubbed AdFection. Operating an ad platform known as Controlium, Discover-Tech used real-time bidding exchanges run by Google, Yandex, and Beeswax to inject malicious JavaScript into web browsers and mobile apps. When an ad rendered on a target’s screen, it connected back to Discover-Tech’s servers without requiring any click, download, or interaction from the user.
#Karkadann (#Candiru) domains, mostly typosquatting Azeri websites. #ThreatHunting ⤵️checkhotel[.]netvergisorgula[.]comkoronamiyim[.]comopinionlimit[.]orgseffafxeber[.]comparkdev[.]netcaptivelogin[.]netolkem[.]net pic.twitter.com/u6LRsNJB87
According to Reuters, the malicious ads reached more than 120,000 websites and 75,000 apps. Confiant cofounder Jerome Dangu estimated that Discover-Tech pumped out at least 10 million ads per day globally. Tech Insider noted that between March and June 2026, Discover-Tech’s MyDSP platform bid on nearly 3.77 billion impressions and won about 442 million of them. Confiant’s parallel investigation noted that these malicious ads were shown to users in hundreds of networks in sensitive categories, including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
The Citizen Lab report was published by the research group at the University of Toronto. Historical context provided by Citizen Lab demonstrates that the lab has spent time documenting the evolution of mercenary spyware delivery methods, stretching back to early commercial spyware campaigns tied to NSO Group’s Pegasus that relied on one-click links sent via SMS or messaging apps. By contrast, the AdFection technique works by exploiting the targeted-advertising supply chain rather than a messaging app or a malicious attachment. Researchers pointed out that there is no consumer-facing patch or simple setting that blocks a zero-click ad-delivered exploit, because the exposure runs through an advertising relationship rather than a bug in an operating system.
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.A normal-looking ad loads. If you're a target, you're infected. No click needed.To protect yourself, block ads now.First time it's been confirmed in the wild. We call it #AdFection.Candiru spyware… pic.twitter.com/pyq8EC7ZE3
During the analysis of the Controlium platform, investigators observed that Discover-Tech published the full source code for Controlium’s frontend on the app’s login page, which allowed them to review and reconstruct the user interface.
Compromised Networks at Al Jazeera, NATO, and the United Nations
The most concrete evidence of active exploitation centers on the Qatari broadcaster Al Jazeera. After noticing suspicious patterns in 2024 and 2025, the network’s in-house technology team shared network logs with Citizen Lab. Researchers confirmed that powerful Candiru spyware compromised 45 Windows devices used by Al Jazeera staff, including journalists reporting on sensitive subjects.
Parallel investigations by Confiant revealed that Discover-Tech advertisements also appeared in critical networks used by international bodies. WIRED reported that these targeted ad impressions touched NATO and United Nations networks, lawmaking bodies in Europe, critical infrastructure in Australia, and armed forces agencies in Norway and Sweden. Some branches of the military have since disabled ad tracking on some devices.
Industry Fallout and Regulatory Scrutiny
The disclosures have triggered swift defensive reactions across the digital advertising ecosystem. Google removed Discover-Tech from its ad platforms, while ad industry body IAB Europe suspended the firm’s status.
7/ How does a spyware operation live inside the global advertising industry for 6 years?It gets certified.Google listed Discover-Tech as a "certified" vendor, IAB Europe* listed them as "approved."This ended with our investigation. Reminder: vetting for these… pic.twitter.com/0XBx7qiZmR
Researchers emphasize that programmatic advertising remains fundamentally vulnerable because publishers and ad exchanges lack visibility into what code runs inside individual ad creatives during sub-second auctions. Wolfie Christl warned about the systemic nature of the risk.
The way online advertising works today is a systemic security threat for states, the private sector, civil society and everyone else alike.
Wolfie Christl, via Reuters and India Today
Candiru itself is no stranger to regulatory blacklists; the US Commerce Department added the spyware vendor to its Entity List in 2021. Following the new findings, PCMag reported that Citizen Lab is pressing regulators to investigate whether Discover-Tech and Candiru—now operating under the name Integrity Labs—violated applicable laws.
Reporting for this story was conducted by Raphael Satter and edited by Edwina Gibbs.
