The Citizen Lab published research this week describing something that sounds like a threat model from a decade of worst-case thinking, except it is documented, evidenced, and apparently been running for years: targeted online advertising used as a delivery pipeline for zero-click mercenary spyware. The report, called AdFection, centers on an Israel-registered company named Discover Technology, or Discover-Tech, and ties it to infections of at least 45 devices at Al Jazeera in 2024 and 2025.
How an ad becomes an infection
The mechanics are the uncomfortable part. Discover-Tech operated as a normal-looking participant in the real-time bidding ecosystem, winning ad auctions like any other advertiser. When one of its ads rendered, the creative called out to what Citizen Lab calls a NOAS, or getAd, server, submitting the viewer’s advertising identifiers and IP address. Most people got back a 0-byte response. A selected target got back JavaScript, and that JavaScript led to a Candiru validator server and then a Candiru command and control server. No click required. Rendering the ad was the attack.
Target selection ran through a platform called Controlium, which let mercenary partners pick victims by mobile advertising ID, cookie ID, or IP address and de-anonymize and infect them automatically. Citizen Lab reconstructed the Controlium panel because Discover-Tech published its own frontend source code on the login page, and found an unauthenticated API endpoint leaking user login records, including logins from at least two Candiru employees and some from Bindecy, another Israeli zero-click exploit firm.
The design choice that kept this alive is almost elegant in a grim way. Because the exploit code never lived inside the ad creative itself, the ad platforms’ scanners never saw anything malicious. The executive summary notes that the platforms serving the ads, including Google and Yandex, had no direct visibility into the payload, which was fetched from Discover-Tech infrastructure only after the ad rendered, and only for targets who matched the profile.
Scale, and where it landed
An exposed Discover-Tech server published almost four billion ad bidding records covering March through June 2026. That dataset shows ads across more than 70,000 mobile apps and 120,000 websites, roughly 200,000 placements in dozens of countries. Household names were in there: bbc.com, nytimes.com, yahoo.com, weather.com, and apps like Viber, Truecaller, Duolingo, and Grindr. The ads sometimes carried branding from third parties including Amazon and AliExpress, with no evidence those companies bought them.
More worrying is where impressions were observed. Discover-Tech ads appeared on networks belonging to NATO, the United Nations, the European Parliament, ministries of defense, national cyber agencies, and critical infrastructure operators. Confiant, which published a parallel investigation, found the malicious ads rendered on networks of the U.S. Department of Defense, Estonia’s Information System Authority, the IAEA, and the International Criminal Court. An impression does not prove infection, but it does prove profiling and targeting reached people browsing those networks.
Aftermath
Discover-Tech sat on Google’s and IAB Europe’s certified vendor lists from 2020 until this month, and leveraged IAB Europe’s consent framework to target users in the EU. After disclosure, Google removed the company from its vendor registries and added Safe Browsing warnings; IAB Europe removed it from the global vendor list; Beeswax, Vungle, and Eskimi cut off or blocked its accounts. Discover-Tech, Candiru (now rebranded Integrity Labs), Bindecy, Intelos, Xandr, and others did not respond to Citizen Lab before deadline.
Candiru itself was entity-listed by the U.S. Commerce Department in 2021 for selling spyware used against journalists, activists, and government officials, so this is not an unknown actor. Citizen Lab also flags a second actor, DARK CARTOGRAPHER, which has used Discover-Tech infrastructure since at least 2019 to link advertising IDs with phone numbers across mobile carriers for mass deanonymization.
What to actually do
Citizen Lab’s practical conclusion is blunt: there is currently no consistently safe way to expose users to targeted ads. For most readers, the changes that matter are boring and effective:
- Run an ad blocker, and consider network-level blocking at the router or gateway so it covers phones and apps, not just desktop browsers.
- Reset your mobile advertising ID and turn off ad tracking in iOS or Android settings; do this on managed devices too.
- If you run infrastructure for an organization, block ad domains at the gateway on government and work devices. Ad rendering is now an attack surface, not a nuisance.
- Defenders can watch for anomalous requests to NOAS-style loader endpoints; Citizen Lab’s report lists indicators including getAd endpoints on mtrtb.com subdomains.
The part I keep coming back to is how ordinary the whole thing looked from the inside. Every hop in this chain, the auction, the vendor list certification, the JavaScript creative, the per-user targeting, is a feature the ad industry built and defended on its own terms. Citizen Lab did not find a novel exploit in the ad stack. They found the ad stack, used as designed, pointed at journalists.