Citizen Lab links mercenary spyware attacks to Israeli ad firm Discover-Tech

Mixed · 2Citizen Lab, a University of Toronto research group, published a report on Thursday 15 October 2026 saying makers of government spyware are abusing advertising networks to hack specific devices by serving malicious online adverts. 1 2 Mixed · 2The report centres on an Israeli company, Discover-Tech, which Citizen Lab says presents itself as a legitimate advertising firm but acts as a "bridge between ad vendors and the mercenary spyware ecosystem"; Wired reports the researchers named the campaign "AdFection". 1 2 Mixed · 2Citizen Lab said at least two makers of zero-click spyware, Candiru and Bindecy, used Discover-Tech's platform, which it calls Controlium; zero-click spyware can infect a device without the victim opening a message or clicking a link. 1 2

Mixed · 2The researchers concluded that 45 devices belonging to Al Jazeera were targeted in 2024 and 2025 through ads and infected with spyware attributed to Candiru; TechCrunch describes them as Windows computers. Al Jazeera took part in the investigation and shared device logs, according to Wired, and did not respond to either outlet's request for comment. 1 2 Mixed · 2Citizen Lab said it was not clear which governments were behind the attacks. Wired reports that infected devices contacted Discover-Tech-linked domains and then Candiru-associated infrastructure. 1 2 Centre · 1The researchers say Discover-Tech left source code exposed on its login pages, which let them recreate the Controlium dashboard, and left login records and billions of ad-bidding records publicly accessible. Some logins belonged to at least two Candiru employees and some to Bindecy. 1

Mixed · 2The bidding records show Discover-Tech ads ran between March and June 2026; Wired puts this at more than 70,000 mobile apps and more than 120,000 websites, and says the researchers estimate millions of devices were directed to Candiru's servers where they could be profiled. The ads appeared on government, military and critical-infrastructure networks, though it is unclear whether those displays led to infections and not all the ads were necessarily weaponised. 2 1 Mixed · 2Wired lists NATO and United Nations networks, European lawmaking bodies, Australian critical-infrastructure providers and Norwegian and Swedish armed forces and agencies among those where impressions appeared. TechCrunch says Confiant, the ad-quality firm that worked with Citizen Lab, found potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court. 2 1 Centre · 1Bill Marczak, a senior Citizen Lab researcher, said the lab had "concrete technical evidence" of a process long speculated about, called Discover-Tech "surely just the tip of the iceberg", and advised people who might be targeted to disable ad tracking or block ads altogether. 1

Left · 1Wired reports that Google blocked Discover-Tech from its ad platforms for systematically violating its policies after a joint investigation with Citizen Lab and Confiant. IAB Europe suspended it from its global vendor list pending further confirmation, and Comcast-owned Beeswax removed it from its platform. 2 Mixed · 2Discover-Tech did not respond to either outlet. The Candiru owner, named as Integrity Labs by TechCrunch and Integrity Partners by Wired, was also not reached or did not respond. 1 2