Ads as an Attack Surface: Researchers Say an Israeli Ad Firm Turned Targeted Banners Into a Zero-Click Spyware Pipeline
A report published Thursday by the University of Toronto's Citizen Lab, working alongside the New York ad-security firm Confiant, names the Israeli digital advertising company Discover-Tech as a facilitator for mercenary spyware. The researchers describe it as a "bridge between ad vendors and the mercenary spyware ecosystem," and call the technique "AdFection": simply displaying an ad can deliver spyware, with no click on a link or file required.
Discover-Tech did not return messages left via its contact form, and emails and a LinkedIn message to chief executive Dekel Boni went unanswered. Al Jazeera and Candiru's side also did not respond. Google said it worked with Citizen Lab and Confiant and blocked the company from its ad platforms "for systematically violating our policies." IAB Europe said Discover-Tech was suspended from its list of globally approved vendors last week, after an audit identified policy violations.
According to Citizen Lab, Discover-Tech runs a platform called Controlium that lets clients "mass-profile and deanonymise" internet users and then covertly hack specific targets with third-party spyware. A real-time bidding system, meant only to decide which users see which ad, was instead used to identify and track individuals.
Before platforms intervened, the operation displayed 442 million ads across more than 120,000 websites and roughly 75,000 mobile apps — at least 10 million ads a day — including placements on the BBC and the New York Times, plus apps such as Duolingo, Badoo and Grindr. Some of the ads promoted ordinary consumer products like phones and wireless earbuds. The researchers stress that ad reach does not mean every device that encountered them was infected.
"Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all," said Bill Marczak, a senior researcher at Citizen Lab. Two zero-click spyware makers, Candiru and Bindecy, used the platform, according to the report; both sell products that infect devices without the victim opening a message or clicking a link. Once in, the spyware can reach messages, photos and emails, record calls and secretly activate microphones.
Citizen Lab says at least 45 Windows computers at Al Jazeera were hit in 2024 and 2025 by zero-click attacks it links with "high confidence" to Candiru spyware delivered through Discover-Tech ads. Infected devices first contacted domains linked to Discover-Tech and then connected to Candiru-linked infrastructure. Network logs shared by Al Jazeera were key to identifying the ad-based nature of the attack.
Confiant found the ads on sensitive networks including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab also traced ad impressions to networks tied to the United Nations, NATO, the European Commission and more than a dozen national governments, as well as corporate networks of chipmakers Nvidia, Sandisk, Broadcom and Micron, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
Candiru was added to the U.S. Commerce Department's Entity List in 2021, accused of supplying software used by foreign governments against journalists, activists and officials. It now operates as Integrity Labs and was acquired in 2025 by the U.S. investment fund Integrity Partners. Discover-Tech was founded in 2020 and is based in Tel Aviv. The researchers said they could not identify which governments were behind the attacks.
Beyond blocking the firm, Google set up warnings in its Chrome Safe Browsing feature for users trying to visit websites linked to the group. "It's disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company's malicious advertising operations for years," said Citizen Lab's Wolfie Christl.
Christl argues that ad blocking should count as a cybersecurity best practice, and recommends resetting or disabling the advertising ID on phones — while conceding it remains "difficult, if not almost impossible, to consistently protect yourself from malicious ads." Marczak was blunter: Discover-Tech is "surely just the tip of the iceberg," and anyone who might be a target should disable ad tracking or block ads outright.