NEW YORK — An Israeli advertising technology company, Discover-Tech, stands accused of transforming ordinary online advertising infrastructure into a sophisticated system for large-scale surveillance and the delivery of "zero-click" spyware, according to parallel investigations released on October 15, 2026, by two independent cybersecurity research groups, Citizen Lab at the University of Toronto and New York-based advertising security firm Confiant. The reports allege that this system was used to compromise at least 45 Windows devices belonging to employees of the Qatari broadcaster Al Jazeera between 2024 and 2025, without requiring users to click on any advertisements.
These findings, which Citizen Lab has termed "AdFection," mark the first publicly documented instance of targeted online advertising being leveraged to deliver commercial spyware with zero user interaction. The revelation highlights a significant vulnerability within the global digital advertising ecosystem, demonstrating how infrastructure originally designed for consumer targeting can be repurposed for intelligence gathering and malicious activities, thereby posing substantial national security and privacy risks.
Discover-Tech, established in 2020, presented itself as a legitimate player in the online advertising sector. However, researchers allege its primary function was to serve as a conduit between mercenary spyware companies and the vast online advertising landscape. The company operated a platform named Controlium, which reportedly bridged digital advertising infrastructure with commercial surveillance technologies.
The alleged surveillance system exploited the fundamental mechanics of programmatic advertising and real-time bidding (RTB). When an internet user navigates to a website or utilizes a mobile application that displays advertisements, an instantaneous auction takes place. During this process, data about the user and their device is broadcast to numerous potential advertisers. Discover-Tech's advertisements, often promoting mundane products such as mobile phones or earbuds, contained embedded code designed to communicate with its servers upon display. This interaction, crucially, did not necessitate a user click, transmitting device information, including advertising identifiers, IP addresses, and other metadata, back to Discover-Tech.
According to the cybersecurity researchers, Discover-Tech's Controlium platform enabled its clients to identify and profile internet users through this passively collected data. If a specific device was identified as a target, Discover-Tech's servers could then deliver additional, malicious code engineered to exploit vulnerabilities and install spyware. This "zero-click" capability meant that a device could potentially be compromised simply by loading an advertisement, without any deliberate user interaction. Confiant co-founder Jerome Dangu noted that the malicious code was particularly challenging to detect through conventional advertising verification methods because the content delivered could vary depending on the specific device and user being targeted.
The scale and reach of Discover-Tech's alleged operation were extensive. Citizen Lab's analysis of approximately 3.77 billion advertising bids conducted between March and June 2026 indicated that Discover-Tech's advertisements appeared across nearly 200,000 websites and mobile applications in dozens of countries. Confiant's Dangu estimated that Discover-Tech was issuing at least 10 million ads daily worldwide. He further suggested that data-sharing arrangements, such as cookie matching, allowed the company to track individuals even beyond the direct reach of its advertisements, concluding that "very likely hundreds of millions of people would have been touched by Discover-Tech."
Beyond tracking, researchers allege that Discover-Tech would, under certain circumstances, attempt to extract phone numbers from smartphone users. Citizen Lab also documented a separate but related operation, attributed to a threat actor dubbed "DARK CARTOGRAPHER," which reportedly exploited vulnerabilities in mobile telecommunications networks to associate advertising identifiers with telephone numbers. Further technical details on this specific operation are expected to be published separately, according to the researchers.
The investigations draw strong links between Discover-Tech and the Israeli spyware company Candiru, which was blacklisted by the U.S. Commerce Department in 2021. Candiru faced allegations of supplying spyware used to maliciously target government officials, journalists, activists, and academics. The reports state that Candiru has reportedly operated under the name Integrity Labs. Discover-Tech's services allegedly provided Candiru and other Israeli surveillance firms with access to advertising platforms operated by major companies including Google, Comcast, and Russia's Yandex.
Citizen Lab's report also identified connections between Discover-Tech and other commercial surveillance companies, including Bindecy and Intelos, suggesting that Discover-Tech's infrastructure served multiple clients within the mercenary hacking and surveillance industry. Citizen Lab stated it found no evidence that Discover-Tech was engaged in legitimate advertising activity, noting that Discover-Tech's CEO, Dekel Boni, has a background in digital advertising, with the company associated with individuals well-known in the mercenary spyware industry for almost six years.
A particularly alarming finding from Confiant's report is the alleged exposure of devices and networks associated with sensitive organizations. Confiant reported that malicious Discover-Tech ads were displayed on "hundreds of networks in sensitive categories," including those linked to the Pentagon (U.S. Department of Defense), NATO, the United Nations, the European Commission, the International Criminal Court, and the International Atomic Energy Agency.
It is critical to differentiate between an advertisement "appearing on a network" and a successful compromise or surveillance of that network. While the reports indicate that Discover-Tech ads were rendered on devices within these sensitive networks, they do not establish that any of these organizations were successfully compromised or surveilled beyond the documented Al Jazeera case. However, researchers emphasize that the mere exposure minimally suggests profiling of these devices by Discover-Tech and/or its surveillance partners. This aligns with earlier concerns raised by the Pentagon, which reported in 2026 that U.S. military personnel in war zones had been targeted using location data harvested by ad tech firms, leading some military branches to disable ad tracking on certain devices.
Following the disclosures by Citizen Lab and Confiant, several major advertising platforms and industry bodies initiated actions against Discover-Tech. Google announced that it had collaborated with Citizen Lab and Confiant on the investigation and subsequently removed Discover-Tech from its advertising platforms "for systematically violating our policies." Google also implemented Safe Browsing warnings for domains associated with Discover-Tech's operation to protect users across various browsers.
Other industry players followed suit. IAB Europe, an association representing the digital marketing and advertising industry, suspended Discover-Tech from its list of globally approved vendors after an audit identified policy violations. Comcast's advertising technology subsidiary, Beeswax, removed Discover-Tech from its platform "following recent activity." Vungle (Liftoff) suspended the company pending a review, and Eskimi blocked associated accounts and domains.
Discover-Tech did not respond to requests for comment from Reuters, with messages left via its contact form, LinkedIn, and emails to CEO Dekel Boni going unanswered. Reuters was also unable to reach Candiru's owners for comment. Al Jazeera, however, issued a statement condemning the spyware attacks and affirming its commitment to protecting its employees and systems, noting that its cooperation "helped verify and publicly document these attacks."
These investigations underscore a critical and systemic vulnerability within the global advertising ecosystem. Real-time bidding, while enabling highly targeted advertising, inherently involves the broadcast of extensive personal data—including device type, location, IP address, browsing behavior, and unique advertising IDs—to thousands of companies in milliseconds. Privacy advocates have long contended that RTB is fundamentally a surveillance system, creating vast pools of "bidstream data" that can be linked to real individuals and exploited for purposes far beyond advertising. The Discover-Tech case vividly demonstrates how this infrastructure, originally built to target consumers, can be weaponized for intelligence gathering and the silent delivery of sophisticated spyware, even to sensitive government and international networks, highlighting a systemic security threat that extends beyond individual privacy concerns to national security.