An Israeli company posing as an advertising firm used the global online ad system to deliver "zero-click" spyware and to track potentially millions of devices, according to reports published Thursday, Oct. 15, 2026, by the University of Toronto's Citizen Lab and ad-security firm Confiant. Citizen Lab called it the "first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads."
The researchers say the company, Discover-Tech, served as a bridge between ad exchanges and spyware vendors, including Candiru, an Israeli firm the U.S. Commerce Department blacklisted in 2021. Citizen Lab found that at least 45 devices inside the Qatar-based broadcaster Al Jazeera were targeted in 2024 and 2025, and attributed that attack with "high confidence" to Candiru.
Confiant's researchers told reporters that Discover-Tech ads also appeared on networks linked to the U.S. Department of Defense, a claim that points to an ad-tech blind spot with direct implications for U.S. national security.
Key Facts
- When: Reports published Oct. 15, 2026; activity documented from at least 2024 into mid-2026.
- Where: Discover-Tech is based in Israel; ads reached devices worldwide; Citizen Lab found the most bids in Yemen, Pakistan and Montenegro, while Confiant saw high concentrations in Palestine and Belgium.
- Who: Citizen Lab researchers Bill Marczak and Wolfie Christl; Confiant co-founder Jerome Dangu; Discover-Tech CEO Dekel Boni; spyware vendor Candiru, now operating as Integrity Labs.
- Scale: About 3.77 billion ad bids and 442 million won ad placements by Discover-Tech's platform in March to June 2026, per Citizen Lab.
- Reach: Attacker scripts appeared in ads on 75,373 apps and 120,768 websites.
- Victims confirmed: At least 45 Al Jazeera devices targeted; no government client publicly identified.
- Industry response: Google, IAB Europe and Comcast's Beeswax removed or suspended Discover-Tech.
- Status: Verified as the published findings of two independent research teams; individual infections beyond Al Jazeera are not confirmed.
What Happened
Citizen Lab's report, "Exposing AdFection," describes how an ordinary-looking banner could carry a hidden script tag. When a targeted device loaded the ad, the script reported identifiers such as the phone's advertising ID or browser cookie to a Discover-Tech server, which checked them against a target list.
Devices that matched received code that led to a spyware server; all others received an empty response. Because the ad itself carried no exploit, it could pass the security scans ad platforms run, the report says. Citizen Lab concluded that "the simple display of a targeted ad is enough for infection." It urged that "ad vendors must significantly level up their cybersecurity and threat detection capacity," The Record reported.
The researchers found "no evidence that Discover-Tech was engaged in legitimate advertising activity," according to Citizen Lab's executive summary, and said serving as a bridge to spyware vendors appears to be its "primary purpose."
The Al Jazeera case
Al Jazeera's technology team noticed unusual patterns on journalists' devices in 2024 and asked Citizen Lab to investigate, according to the Committee to Protect Journalists. Network logs showed targeted devices contacting a Discover-Tech server, then a Candiru "validator" server, then a command server, according to the Citizen Lab report; TechCrunch reported that Windows computers were targeted.
Citizen Lab recovered a Windows file from one compromised machine that matched a newer version of Candiru's known malware. Al Jazeera said it "condemns the spyware attacks targeting a number of its staff" and called for those responsible to be held accountable. Researchers could not determine which government or client ordered the operation, CyberScoop reported.
Confiant's findings
Confiant, which monitors ads for malicious code, said its scanner flagged a Discover-Tech creative on April 12, 2026. Over the following months it observed about 10 million Discover-Tech impressions a day in 228 countries, according to its report. It also found ads that read browser cookies, sometimes including "live authenticated sessions of logged-in users."
"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu told Reuters, as published by The Times of Israel. That is an estimate of exposure, not of infections. The exploit used to break into devices was not recovered, so no software vulnerability has been publicly identified or patched, The Hacker News reported.
"The way online advertising works today is a systemic security threat." — Wolfie Christl, Citizen Lab, via Reuters
Timeline
| Date/Time ET | Event |
|---|---|
| 2020 | Discover-Tech founded in Israel |
| July 15, 2021 | Microsoft and Citizen Lab publicly expose Candiru's spyware |
| Nov. 3, 2021 | U.S. Commerce adds Candiru and NSO Group to the Entity List |
| 2024-2025 | At least 45 Al Jazeera devices targeted |
| April 2, 2025 | U.S. fund Integrity Partners buys Candiru's operations |
| March-June 2026 | Citizen Lab dataset: 3.77 billion bids |
| April 12, 2026 | Confiant flags a Discover-Tech ad |
| Early October 2026 | Google and IAB Europe drop Discover-Tech (Citizen Lab) |
| Oct. 15, 2026 | Citizen Lab and Confiant publish reports |
Who's Involved
- Discover-Tech: Israel-based firm led by CEO Dekel Boni, according to Citizen Lab. It did not respond to requests for comment from Reuters or CPJ.
- Candiru / Integrity Labs: Israeli spyware maker on the U.S. Entity List since 2021; its assets were acquired in 2025 by U.S. fund Integrity Partners, CTech reported; Citizen Lab refers to the successor as Integrity Labs, which could not be reached, per TechCrunch.
- Citizen Lab: Senior researcher Bill Marczak called Discover-Tech "surely just the tip of the iceberg," per TechCrunch.
- Google: Removed Discover-Tech "for systematically violating our policies," Reuters reported.
- IAB Europe and Comcast's Beeswax: Suspended or removed the firm; Liftoff's Vungle paused access pending review.
- Al Jazeera and CPJ: CPJ deputy director of research Jonathan Rozen said "the mass surveillance architecture supporting online advertising is being harnessed for other purposes."
- Israeli government: No public response found.
The OSINT Picture
Citizen Lab drew on bidding data from Discover-Tech's own ad platform, MyDSP, covering about 3.77 billion bids from March to June 2026. About two-thirds of those bids ran through Russia's Yandex exchange and about one-quarter through Google Ad Manager, according to the report.
The ads appeared inside widely used apps and sites, including Duolingo, Viber, Truecaller, Yahoo Mail, the BBC, AccuWeather, Fox News and The New York Times. Those publishers were carriers, not participants. Citizen Lab cautions that "a Discover-Tech ad impression does not in and of itself confirm targeting or infection."
Citizen Lab also found, but did not exploit, security flaws in Discover-Tech's control panel, Controlium: an unprotected page exposed 128 days of login logs, the report says, including logins by at least two Candiru employees, TechCrunch reported. Impressions were also seen on networks of NATO, the European Commission and the European Parliament, according to Citizen Lab's executive summary.
Confidence: High that Discover-Tech's platform delivered targeting scripts linked to Candiru; high for the Al Jazeera targeting; low for any claim of mass infection, which neither report makes.
Geopolitical Players
- Israel: Home to Discover-Tech, Candiru and other firms named in the report. Citizen Lab links Discover-Tech to the Intellexa spyware group through a company tied to Sara Hamou that held Discover-Tech shares until March 2026. The U.S. Treasury sanctioned Hamou in 2024 and lifted those sanctions on Dec. 30, 2025, The Hacker News reported.
- Qatar: Al Jazeera, a Qatari-funded broadcaster, is the confirmed target. The researchers did not attribute the attack to any government.
- Palestine and Yemen: Confiant found that 1 in 36 Android ads in Palestine came from Discover-Tech; Citizen Lab found Yemen had the most bids by volume.
- Russia: Yandex carried 67.4% of the platform's bids and did not respond to Reuters.
- Europe: Belgium accounted for 56% of the Candiru-linked ad hits Confiant observed, and EU institutions appeared among impressions.
What It Means for the United States
Benefits and opportunities
- Fast industry response: U.S. companies, including Google and Comcast, cut Discover-Tech off once alerted, showing private-sector cooperation can disrupt foreign spyware pipelines.
- Defensive roadmap: The reports publish indicators that U.S. agencies and companies can use to hunt for past intrusions.
- Policy leverage: The findings give Commerce and Treasury a documented basis for possible new designations.
Risks and dangers
- Defense networks exposed: Confiant told CyberScoop and other outlets that Discover-Tech ads reached Pentagon-linked networks; impressions alone are not infections, but the access path is real.
- Sanctions loophole (analysis): A blacklisted vendor kept operating through ad exchanges run by U.S. companies after its assets moved to a new entity not covered by the Entity List, per The Hacker News.
- Mass data collection: Confiant found U.S. users accounted for 48% of Discover-Tech's cookie-matching traffic.
- Ad-tech as attack surface: Marczak advised that anyone who might be targeted should disable ad tracking, per TechCrunch.
Get the full Intel Briefing. Pro Truth Seeker members get members-only deep dives on spyware and intelligence threats, the daily Intel Briefing and the full archive. Become a member.
What's Next
- Follow-up report: Citizen Lab says a separate report on an actor it calls DARK CARTOGRAPHER, whose infrastructure overlaps with an unnamed U.S. government contractor, is forthcoming.
- Reviews: Vungle's review of Discover-Tech is pending.
- Government action: No U.S. statement had been found as of Oct. 16; Christl urged U.S. and European regulators to investigate, per CyberScoop.
Support independent OSINT reporting: support the Information War, or subscribe to the Ecker Dispatch.
Sources
- Citizen Lab: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, Oct. 15, 2026
- Citizen Lab: Exposing AdFection Executive Summary, Oct. 15, 2026
- Confiant: ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming, Oct. 15, 2026
- The Times of Israel (Reuters): Israeli company used online ads to run vast spy operation, researchers say, Oct. 15, 2026
- TechCrunch: Citizen Lab says governments are abusing online ads to hack people with 'zero-click' spyware, Oct. 15, 2026
- CyberScoop: AdFection: How mercenary spyware invades victims' devices through targeted advertising, Oct. 15, 2026
- The Hacker News: Citizen Lab traces zero-click Candiru spyware delivered via ads, Oct. 15, 2026
- Al Jazeera: Israeli ad-tech firm helped place spyware on Al Jazeera devices, Oct. 15, 2026
- Committee to Protect Journalists: Israeli ad tech firm enables spyware targeting of at least 45 Al Jazeera devices, Oct. 15, 2026
- The Record: Zero-click spyware infecting devices through online ads, researchers say, Oct. 15, 2026
- CTech by Calcalist: Integrity Partners acquires Candiru, April 2, 2025
- U.S. Department of Commerce: Commerce Adds NSO Group and Other Foreign Companies to Entity List, Nov. 3, 2021
- The Hacker News: US Treasury lifts sanctions on three Intellexa-linked individuals, Dec. 31, 2025