An Israeli advertising company quietly turned the infrastructure of targeted digital ads into a delivery mechanism for mercenary spyware, according to new research from the Citizen Lab at the University of Toronto. The findings, published October 15, represent the first publicly confirmed case of zero-click government-grade spyware delivered through online advertising.
The company at the center of the report is Discover-Tech, registered in Israel and run by CEO Dekel Boni. On its surface, Discover-Tech operated like any other demand-side advertising platform, placing bids across major ad exchanges and running campaigns through networks including Google, Yandex, Liftoff and Comcast's Beeswax. Underneath that veneer sat a second product entirely: a targeting tool called Controlium that, researchers say, was designed to push malicious code to specific individuals based on their device ID, browser cookie, or IP address.
The mechanism is what makes this case technically significant. When a user's device connected to the ad infrastructure and matched an attacker's target list, Discover-Tech's "NOAS server" would return a fragment of JavaScript rather than an ordinary ad. If the device was not a target, the server returned nothing at all, which helped conceal the malicious activity from the ad vendors relaying the traffic. The user never clicks anything. The ad impression itself is the attack.
Citizen Lab researchers call this technique AdFection.
Al Jazeera
Between 2024 and 2025, at least 45 Windows devices at Al Jazeera were compromised this way. Researchers attribute the attacks with high confidence to Candiru spyware, now rebranded as Integrity Labs. The technical trail includes a Windows DLL recovered from a compromised machine that hard-coded command-and-control servers bearing a fingerprint consistent with Candiru's known infrastructure, along with a 48-byte repeating XOR encryption key and a persistence method, COM hijacking, matching Candiru's attack chain from 2021.
Researchers traced the full infection sequence: an ad impression served through Discover-Tech's infrastructure, contact with a Candiru validator server, and then with a Candiru command-and-control server. The governments behind the targeting remain unidentified.
Who was behind Discover-Tech
The research places Discover-Tech in a web of relationships with the commercial spyware sector. Eric Banoun, whom the Israeli newspaper Haaretz has described as one of the pioneers of offensive cyber in Israel, served as a director at Discover-Tech from 2020 to 2025. He also held shares in Intelos, a firm that appears elsewhere in the report as an ADINT surveillance company with at least 15 linked users on the Controlium platform.
Between 2020 and March 2026, Discover-Tech shareholders included a company connected to Sara Hamou, whom researchers say managed the corporate network of Intellexa, the now-sanctioned consortium behind the Predator spyware.
A second spyware vendor, Bindecy, also used the Controlium platform. Researchers identified Bindecy operators in Belgium, Germany, Norway, Portugal, Sweden, Singapore, and Spain. The company did not respond to requests for comment.
What the data showed
Citizen Lab's analysis drew on roughly four billion bid records from an Apache Druid database instance that Discover-Tech left publicly accessible. Between March and June 2026, Discover-Tech's MyDSP platform bid on more than 3.7 billion ad impressions and won approximately 441 million. About 19 percent of those bids carried the NOAS script tags that power the spyware delivery system.
Ads bearing those script tags ran across 75,373 mobile apps and 120,768 websites. Researchers identified ad impressions on networks tied to NATO, the United Nations, the European Parliament, the European Commission, and government bodies in Norway, Sweden, Denmark, Australia, Israel, Czechia, and Italy. Separate findings by ad security firm Confiant, which worked in parallel with Citizen Lab, placed potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court.
Citizen Lab was careful to note that an ad impression does not confirm a device was successfully compromised. The researchers are calling on regulators to investigate whether Discover-Tech and Integrity Labs violated applicable laws.
Industry response
Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026, ahead of the report's publication. Beeswax removed the company from its platform. Liftoff paused its access. Eskimi blocked its accounts and associated domains.
Discover-Tech did not respond to requests for comment. Integrity Labs could not be reached.
Bill Marczak, one of the Citizen Lab researchers who led the investigation, told TechCrunch that Discover-Tech is "surely just the tip of the iceberg" and advised people who believe they may be surveillance targets to disable ad tracking or use an ad blocker as a precaution.
The full report,
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: