Google and IAB Europe removed Israeli ad company Discover-Tech from their vendor registries in early October 2026, after a Citizen Lab investigation published on October 15 found that ads bought by the company were used to deliver Candiru's mercenary spyware to at least 45 devices at Al Jazeera, without a single click.

In Short

Researchers at the University of Toronto found that a company presenting itself as an ordinary ad buyer used online ads to break into phones and computers, including devices at the news network Al Jazeera, just by showing an ad on screen. The company had been listed as an approved vendor by Google and the industry group IAB Europe for almost six years, so its ads ran in tens of thousands of apps and websites that many people use. Google, IAB Europe and several ad platforms have now cut the company off, and the researchers want regulators to investigate and the ad industry to check its partners far more carefully.

A report with a name for a new technique

The Citizen Lab, a research group at the University of Toronto, published "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware" on October 15, 2026. The authors are Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. The report was co-timed with a parallel investigation by the ad security company Confiant.

According to the Citizen Lab, the report is "the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads." The researchers call the technique AdFection. The central claim is short and uncomfortable for anyone who buys or sells programmatic media: the display of a targeted ad was enough to start an infection, with no click required.

Three parties sit at the centre of the findings. Discover-Tech Ltd is an Israeli company registered in March 2020 that presents itself as a demand-side platform operator. Candiru is an Israeli-founded spyware vendor, now operating as Integrity Labs after what Israeli media reported in April 2025 was a $30 million acquisition by U.S.-based Integrity Partners. Al Jazeera, the international news network, provided the network logs that allowed the researchers to reconstruct the attack and agreed to be named.

Discover-Tech did not respond to the Citizen Lab's request for comment within the deadline, according to the report. Neither did Candiru/Integrity Labs, Bindecy, Intelos, Xandr (Microsoft Advertising), Sunteng, IAB Europe or Affle. The Citizen Lab sent requests to 13 companies in total.

What the report documents, and what it infers

The report mixes direct technical evidence with assessments, and it labels them differently. That distinction matters for how the findings are read.

What the researchers say they documented directly: network logs from Al Jazeera showing a repeated sequence of contact with Discover-Tech domains, then a Candiru validator server, then a Candiru command-and-control server; a Windows DLL recovered from a compromised Al Jazeera device with hardcoded command servers matching their Candiru fingerprint; the publicly exposed source code of a Discover-Tech platform called Controlium; login records pulled from an unauthenticated endpoint; and nearly four billion bidding records left world-readable on a Discover-Tech server.

What the researchers assess or infer: that Discover-Tech "appears to be a front for large-scale ad espionage abuse"; that serving as a bridge to spyware vendors "appears" to be its primary purpose; that the millions of users sent to certain domains were profiled for Candiru; and that specific Controlium users belong to Candiru, Bindecy or Intelos. The report attributes the Al Jazeera attack to Candiru "with high confidence," which is its own stated confidence level rather than an established legal finding.

How AdFection works

The mechanics described in the report rely on two ordinary features of real-time bidding. Bid requests carry granular information about a user, including device identifiers, IP addresses and sometimes precise location, which lets a buyer decide to bid on one specific person. And an ad is rarely just an image: it can carry HTML and JavaScript that run in the app or browser while the ad is displayed.

According to the report, many Discover-Tech ads contained a script tag pointing to what the company called a "NOAS server," also referred to as a "getAd server." When the ad rendered, it called back to Discover-Tech, submitted the user's cookie ID or mobile advertising ID, and automatically executed any JavaScript returned. The NOAS server decided, apparently from the IP address and identifiers, whether the device was a target. Targets received code. Everyone else received a 0-byte response.

That design, the report says, allowed Discover-Tech "to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads." In most cases the viewer was not selected, yet the ad still gathered data from the browser and sent it back to Discover-Tech, which could include cookies set on the page and the device's public IPv6 address.

The Al Jazeera attacks took place in 2024 and 2025. At least 45 devices within the network were targeted. The researchers built a fingerprint for Candiru validator servers and found 305 distinct domain names on 319 IP addresses matching it between August 2022 and July 2026, sampling one historical Censys snapshot per month to save query costs. They also note the behaviour "gradually began being retired" in May and June 2026.

The recovered DLL, according to the report, shares several traits with the Candiru chain the Citizen Lab captured in 2021: a COM hijack for persistence, strings obfuscated with a 48-byte repeating XOR key, a "dummy" null terminator in obfuscated strings, and the same ordered connectivity check against google.com and microsoft.com. On that basis the researchers conclude the sample is "a newer version of the Candiru attack chain that we captured in 2021."

This is not the first time PPC Land has covered ads used as an infection channel. In July 2026, Confiant documented SourTrade, a campaign that had victims' browsers assemble their own Windows executable across 12 countries. SourTrade, however, needed a victim to download and run something. The AdFection chain described by the Citizen Lab did not.

Controlium: a campaign manager for targeting individuals

The most detailed section of the report covers Controlium, a Discover-Tech platform that the researchers say lets customers push "controlled ads" to individual targets. According to the Citizen Lab, Discover-Tech published the full frontend source code on the app's login page, which is standard for many web applications. The researchers saved the page, stripped out external connections and explored every screen.

The admin side, according to the report, lets Discover-Tech grant customers web or API access, white-label the product with a different logo, restrict access by IP, limit daily and monthly campaigns, set domain and app allowlists, and restrict countries through allowlists or blocklists. There are also "OpSec" settings that appear designed to stop customers from bidding too often or too broadly.

On the customer side, users can target by iOS or Android ad ID, by MyDSP or Beeswax cookie ID, and by IP address. They can choose a buying route: Beeswax, Eskimi, or Discover-Tech's own MyDSP, which in turn can bid through Google's or Yandex's exchange. Dropdown options in the code include "MyDSP WW," "MyDSP Yandex RU," "Beeswax (Palm 3)" and "MyDSP Google (Palm 3)." A campaign module offers URL types labelled "Ad URL," "Test URL," "Script," "User Agent," "Monitor," "Pixel" and "De-anon." The researchers say they are unsure what most of these mean, though they believe "Script" may allow arbitrary JavaScript to run.

Other modules, according to the report, show bid requests and ad impressions for a target identifier or IP address from the last 30 minutes, including the website or app being used. The researchers note these tools "can be used for troubleshooting and verification purposes, but also to spy on targets and other users whose data is in the bid requests."

Two security findings stand out. First, Controlium's authorization token could, the researchers assess, be spoofed easily, because the platform ignored the signed JWT returned by Okta's Auth0 and passed an encrypted user object instead, using a key published in the platform. The correct code was present but commented out. The researchers did not test the flaw, saying doing so would have been unauthorized access. Second, an endpoint called "/csv-download" returned login logs with no authentication at all. From it, they exported 128 days of logs covering 120 distinct usernames.

The report ties Controlium to Discover-Tech through CNAME records pointing to a load balancer named "discovertech-alb," strings such as "controlium-discover-tech," and a message at one endpoint reading "ONLY DEKEL IS ALLOWED!!!" The researchers describe the last as "a possible reference to Discover-Tech's CEO Dekel Boni."

Who logged in

According to the report, two Controlium users signed in from an Israeli IP address the researchers attribute to Candiru/Integrity Labs. One matched the name of a person listed on LinkedIn as "Head of Presale" at a page called "Cyber Security Company." The researchers note that LinkedIn's "pages people also viewed" panel for that page shows Integrity Labs, NSO Group and a misspelled "Integrity Lab" in its top three spots. The second username ended in "_pap_pres," which the researchers suspect stands for presale, though they say they cannot be certain of the person's identity. These two users signed in from Azerbaijan, Czechia, Israel, Italy, Mexico, Montenegro, the UAE and the United States.

The report links other usernames to Bindecy, an Israeli spyware firm that Haaretz has described as "one [of] Israel's lesser known spyware firms," via self-signed certificates issued by "cupid-ca" and a Heroku app named "bd-mainserver." According to the researchers, partners told them Bindecy has products called "Archer" and "Cupid." They identified Bindecy operators in Belgium, Germany, Norway, Portugal, Sweden, Singapore and Spain.

At least 15 Controlium users are linked to Intelos, an Israeli advertising intelligence vendor, according to the report. The connection runs through certificates for globaldatapoints[.]com and a subdomain that briefly served a login page for "AD/HOC," reported elsewhere as an Intelos product. Advertising intelligence, or ADINT, is the use of ad auction data for surveillance. In May 2026, PPC Land covered two Israeli firms selling ADINT tools that could identify Starlink users from mobile advertising identifiers, a sign that this sub-industry was already visible before the Citizen Lab's report.

The four-billion-record database

The scale estimates in the report come from two Apache Druid instances that, according to the researchers, were world-readable on Discover-Tech's mtrtb[.]com domain until the company shut them down in August 2026. They covered MyDSP, not Beeswax or Eskimi.

Between March and June 2026, MyDSP bid on 3,770,286,576 impressions and appears to have won 441,954,291, or 11.7%. About 76.7% of bids were for in-app inventory and 23.3% for web. The exchange field broke down as follows, according to the report:

  • Yandex: 67.4%
  • Google Ad Manager: 24.74%
  • Vungle: 7.24%
  • Google retargeting: 0.05%
  • Sunteng: 0.03%

The database contained no cookie IDs, advertising IDs or GPS coordinates, according to the researchers, but it did hold IP addresses or /24 ranges and city-level geolocation.

"No good evidence of legitimate ads"

This is the section most relevant to anyone assessing vendor risk. According to the report, the database lists only three advertisers across nine advertiser-domain combinations, and most trace back to Discover-Tech itself or entities the researchers consider linked to it. "discover-tech" advertising akedo.gg accounted for 37.31% of bids. "AliExpress" accounted for 34.70%, and "MyIpInfo" for 12.65%.

The AliExpress ads, according to the researchers, all used a generic "SALE" image showing products from Ugreen, and some landed on an AliExpress affiliate link. The report states it has "no evidence of a business relationship between Discover-Tech and AliExpress and/or Ugreen," and that the generic creative, absence of revenue and absence of conversion data suggest the ads "were likely not purchased on behalf of AliExpress or Ugreen." It also says it has no evidence Amazon or AliExpress bought any of the branded "controlled ads."

MyDSP recorded spend of about $109,091 over the four months, assuming costs were stored in micros of USD, according to the report. Fields for advertiser revenue, DSP profit and margin were always zero except for three days in June. Conversions were always zero. The researchers concede it is "conceivable that the bidding records might not track and record this information," but describe a vendor with no conversions at all as "highly unusual."

Where the ads ran

At least 718,748,885 bids, about 19%, were for ads that apparently contained a NOAS script tag, according to the report. The researchers flagged these by searching ad names for "infi," "NOAS," "ppv2" and "pqv2." Those bids targeted IP addresses in 161 countries. Yemen led by raw volume with 457,283,658 bids, followed by Pakistan (139,427,322) and Montenegro (97,595,716). Per capita, Montenegro was far ahead at 156.68 bids per person, against 13.99 for Yemen. The report cautions that IP geolocation can be wrong because of satellite providers and VPNs.

Ads with these script tags were actually displayed in 75,373 Android and iOS apps and on 120,768 websites, according to the report. That is the basis for the "almost 200,000" figure in the key findings. Android apps that displayed more than one million of them included MX Player and Lark Player. Viber showed more than 700,000 on Android and around 200,000 on iOS. The researchers also list Truecaller, Snap VPN, Yahoo Mail, Opera Mini, Duolingo, WeMuslim, Grindr and Badoo among apps that displayed the ads in varying volumes.

On the web, the report names mamul.am in Armenia and kurir.rs in Serbia as sites that each displayed more than one million. Weather.com displayed around 400,000. The long tail, according to the researchers, included 9gag.com, foxnews.com, bbc.com, cbc.ca, haaretz.co.il and nytimes.com. The researchers were themselves served Discover-Tech ads while browsing the CBC and Yahoo sites and while using a Sudoku app on Android.

None of this means those publishers did anything wrong. The ads reached them through standard programmatic pipes, which is precisely the point the report makes.

Sensitive networks

The report identifies impressions on networks of NATO, the United Nations, the European Parliament, the European Commission and the Council of the EU's General Secretariat. It lists networks in Norway (including the Stortinget and police IT), Sweden (the Armed Forces, grid operator Svenska Kraftnat, Saab), and Denmark (Banedanmark, Vestas, Orsted, Copenhagen Airports). It also names Intel, Nvidia, Apple, Microsoft, Raytheon and Elbit Systems among corporate networks, and government networks in 24 countries.

The researchers are explicit about the limits: "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware." Their minimum assessment is that the impressions "would have resulted in profiling by Discover-Tech."

Confiant, in its parallel work, found signs the ads were displayed on networks of the U.S. Department of Defense, the Dutch Ministry of Economic Affairs, Estonia's Information System Authority and the International Criminal Court, according to the Citizen Lab.

Millions sent to Candiru servers

Beyond the targeted Al Jazeera attack, the report describes what it calls likely mass reconnaissance. Starting in April 2025, Discover-Tech ads distributed URLs pointing to sincereaccertain[.]com, a domain registered on March 18, 2025, within two hours of two domains that matched the Candiru fingerprint. The URL parameters decrypted, using a key Discover-Tech published on a page called "Ad URL OpSec Decoder" at myipinfo[.]io, to a string of IP address, timestamp, user agent and ad ID.

According to the researchers, between hundreds of thousands and millions of users were directed to these domains before deployment ceased in December 2025. A newer version of the feature, served from ppv2[.]mtrtb[.]com, counted 3,637,213 "eligible users" between January and June 2026, at which point Discover-Tech removed the unauthenticated endpoint. The researchers note that customers other than Candiru may use the same feature.

One Candiru infection link on VirusTotal carried an encrypted parameter that, according to the report, decrypts to an IP address registered to the Saudi Ministry of Foreign Affairs. The researchers present this as indicating the ministry was a "potential target," not a confirmed one.

On the web, the report describes Discover-Tech running cookie syncing with Comcast's Beeswax, Yandex and Microsoft's Xandr. Since May 2025, urlscan archived more than 10,000 records with third-party requests to events.myweb3id[.]io, mostly on Russian websites, and since July 2025 more than 10,000 records involving tracookiepixel[.]xyz, including on IMDb and the New York Times. Requests to Beeswax's bidr[.]io carried the parameter "bee_sync_partners=dtech," which the researchers read as indicating a business relationship. A Yandex endpoint path, "an.yandex.ru/mapuid/discovertechis," is read the same way.

According to the report, Discover-Tech's tracking pixel checks whether a visitor is in a GDPR region and, if so, processes TCF consent signals for three vendors: Discover-Tech Ltd, Xandr Inc and BeeswaxIO Corporation. The researchers argue this "demonstrates how Discover-Tech utilizes its listing as a registered and approved ad vendor by IAB Europe."

"Certified" and "approved" for almost six years

The report's sharpest criticism of the industry concerns vendor lists. According to Table 9 of the report:

  • IAB Europe Global Vendor List: vendor ID 778, listed from July 2, 2020 to October 8, 2026.
  • Google EU Ad Technology Providers: listed from August 12, 2020 to early October 2026.
  • Google Ad Manager Certified External Vendors: vendor ID 4824, listed from November 1, 2020 to early October 2026, with "Can access Google Display Network (GDN): Yes."
  • Google ads personalization providers: provider ID 3036, with domains mtrtb.com, mydsp.io and tracker.mtrtb.com.

Google's list of roughly 2,400 Certified External Vendors requires a "business review," according to the report, which notes the nature of that review is not specified. Google also lists about 1,000 Ad Technology Providers and about 1,700 ads personalization providers. The GVL holds roughly 1,000 vendors. PPC Land reported in March 2026 that IAB Europe counted 953 registered vendors at the end of 2025 and carried out 587 vendor enforcement procedures and 41 temporary suspensions that year. Those procedures focus on how vendors handle consent signals, which is a different question from who controls a vendor.

The report says IAB Europe takes "reasonable steps to vet and approve" applications, including the "identity of the party or parties controlling the vendor." The researchers counter that Discover-Tech's links to the spyware industry "could be readily obtained from a review of corporate records." Eric Banoun, whom Haaretz described as "one of the pioneers of offensive cyber in Israel," sat on Discover-Tech's board from 2020 until January 2025, according to Israeli company records cited in the report. Banoun co-founded Circles, an NSO Group affiliate, and Senpai Technologies, part of the Intellexa consortium. A British Virgin Islands shareholder, Chaia Services Ltd, held shares until March 2026; Haaretz reported that one of its directors was Sara Hamou, who managed Intellexa's corporate network and was sentenced by a Greek court to eight years in prison, pending appeal.

IAB Europe has operated a vendor compliance programme since 2021 that audits live implementations on publisher sites and can suspend vendors from the GVL. A Belgian court in 2025 limited IAB Europe's joint-controller role to processing TC Strings within the framework. Neither mechanism, on the evidence in this report, is designed to catch a vendor whose ownership raises security concerns.

The report adds a striking implication: Discover-Tech's GVL listing potentially meant that, for almost six years, "hundreds of millions of Europeans were presented with a consent request that, if the recipient clicked 'Agree,' could be construed as authorizing Discover-Tech to process their data under the GDPR."

One registry had not acted at the time of publication. According to the report, Discover-Tech was still listed as of October 2026 in the registry of the Trustworthy Accountability Group, whose stated mission includes fighting "malware threats targeting the digital advertising supply chain." The company also displays the Verified by TAG badge on its own website.

What the vendor lists show now

PPC Land checked Google's downloadable list of ads personalization providers on October 18, 2026. The file now holds 1,687 entries, and provider ID 3036, Discover-Tech LTD, is no longer among them, nor are its domains mtrtb.com and mydsp.io. None of the companies the report links to Discover-Tech - Adtimizer, Volasim, Akedo, MyIPInfo, Tekma or Intelos - appears in the file either. The vendors that cut Discover-Tech off, or were named as routes for its ads, remain listed in their own right: Beeswax under ID 1858 with its bidr.io domain, Eskimi under its Lithuanian legal name Aktyvus Sektorius (1863), Liftoff (1423) with the Vungle domains, Microsoft's Xandr as "AppNexus (Xandr) Inc" (80), Yandex under the name Yango (1033), including the an.yandex.ru domain that appears in the report's ID syncing chain, and Guangzhou Shunfei (1484), the company name the report associates with Sunteng. IAB Europe's Global Vendor List could not be retrieved directly for this article, so the October 8 removal of vendor 778 rests on the report. The live list was at version 181, last updated on October 15, 2026. The report itself draws the distinction: the ad vendors it names "are not necessarily aware of potential misuses of their infrastructure," and Xandr and Sunteng had not responded to the Citizen Lab when it published.

Corporate history: from Matomy to Glispa to Discover-Tech

MyDSP did not begin with Discover-Tech. According to the report, the Israeli ad tech firm Matomy launched it in 2016. In 2018 MyDSP claimed access to 50 billion daily impressions and the ability to target 500 million users. Matomy sold it that year to Cypriot firm Marketcom Technologies, part of Teddy Sagi's Market Group, and a 2019 version of the site shows it as part of Berlin-based Glispa. Google's ID 3036 changed from "MarketDSP" to "Discover-Tech LTD" on July 31, 2020, with the same attributable domains.

Archived MyDSP admin code lists connections to Google, Yandex, Vungle and Sunteng, and also to MobFox, Inneractive, MoPub, PulsePoint, RhythmOne, GumGum, PubMatic, Smaato, Sonobi, NativeAds, Unity, Q1Media and AppLovin, according to the report. The researchers do not say when those connections were active.

Discover-Tech also once operated in a very different corner of the market. In 2021, according to the report, it ran the "Moy A1" app for the Serbian subsidiary of A1 Telekom Austria, and its 2020 website listed A1, Samsung, Tecno and Wiko among customers. Also in 2021, Affle's Dubai unit bought Discover-Tech "business assets" covering its device customization platform. The researchers say they have "no reason to believe that Affle has any control over Discover-Tech's malicious ad operations."

Two linked companies responded and denied involvement. Adtimizer Ltd, whose subdomain dtech.adtimizer[.]co appeared in Discover-Tech's tracking URLs, said the subdomains were "used solely within Discover Tech's infrastructure, which was entirely separate from ours and was not operated, managed, or controlled by Adtimizer," according to the report. Volasim Ltd, the Cypriot developer of the MyIPInfo and Akedo apps that dominate the advertiser list, said it "has no involvement whatsoever in the spyware-related activities" and has "never commissioned, authorized, participated in, or knowingly facilitated any such activity." The researchers state they lack "conclusive evidence" that either company knowingly participated.

What the ad platforms said

According to the report, Google, which collaborated in the investigation, "terminated Discover-Tech's access to its ad exchange platforms, blocking them from bidding or serving ads across our ecosystem," and deployed Safe Browsing protections for known actor-controlled domains.

Vungle (Liftoff) said on October 12: "We have paused all Discover-Tech Ltd. access while we conduct our own review." Beeswax (FreeWheel/Comcast) said on October 13 that "after independent third-party security specialist validation, Beeswax already acted to remove Discover-Tech from Buyer Cloud."

The longest response came from Eskimi on October 14, and it explains why the ads passed verification. "The advertiser's tags were built to evade automated scanning," Eskimi wrote, according to the report. "They loaded different code depending on who was viewing the ad, including the device, IP address and location, and campaigns were often restricted to very narrow IP target lists. This is how they passed third-party verification." Eskimi said Discover-Tech had been a self-service advertiser since 2022, spent "only a few hundred dollars," and ran its last campaign through the Eskimi DSP on August 6, 2026.

That account matters for every buyer and publisher relying on creative scanning. A scanner sees the 0-byte response that non-targets see. The payload only exists for the target.

Xandr and Sunteng did not respond, according to the report. IAB Europe sent a response on October 15, after the deadline, which the Citizen Lab says it published separately. That response was not part of the attached materials.

Why this matters for advertising

PPC Land has covered the security exposure of the bidstream for years. In January 2025, EPIC and the Irish Council for Civil Liberties filed an FTC complaint alleging Google's RTB system exposed Americans' data to foreign adversaries, and in February 2026 a class action accused Google of sending browsing data through RTB to ByteDance, Baidu and Temu. Those cases concern data leaving the auction. The Citizen Lab's report concerns code entering a device through it.

The report also lands on top of a run of ad-delivered harm. In October 2026, PPC Land reported on an analytics engineer phished through a Google search ad for Google Cloud Console. And a Video Advertising Bureau deck covered in September noted that Google suspended about 24.9 million advertiser accounts worldwide in 2025. Account-level enforcement of that kind targets advertisers who break policy in visible ways. Discover-Tech, by the report's account, was not an advertiser in Google's sense but a certified buyer.

Xandr appears in the report through cookie syncing and Controlium's "Detect ZUID" option, which the researchers map to Xandr's user identifier. Microsoft shut down Xandr's Invest DSP in early 2026, but its sync infrastructure remained active as of June 2026, according to the report. Norway's data protection authority fined Xandr NOK 92 million on separate grounds on October 12, 2026, three days before the Citizen Lab's report.

There is a media angle too. The Al Jazeera case joins a long record of spyware use against journalists. PPC Land covered the U.S. ruling that found NSO Group liable for hacking WhatsApp users in December 2024, and the European Media Freedom Act, which limits the use of surveillance software against media workers, took effect in August 2025. The report notes it found impressions on networks of 19 media institutions across eight countries.

For publishers, the report's recommendation to defenders will be harder to absorb. "We judge that the most feasible protection is for defenders to block targeted ads at the gateway," the researchers write. They cite NSA and CISA warnings from 2018 and 2020 recommending ad blocking for government agencies, and call for mandatory ad blocking on government devices and the disabling of unique advertising IDs on government phones. If organisations follow that line, the effect on reachable inventory in government, defence and critical infrastructure networks is plain.

For the industry, the report recommends mandatory know-your-customer checks, third-party audits for "certified" or "approved" vendor lists, threat data sharing, and a "default-deny policy for vendors operating in jurisdictions known to be highly permissive of abuse." It also says existing measures such as the SafeFrame specification "are insufficient or not even adopted in a meaningful way." The report calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs broke the law, and to evaluate legislation "to remove personal data from RTB auctions."

The broader claim is structural. According to the report, the online advertising system "failed to detect or prevent the abuse documented in this report." Discover-Tech used ordinary DSP features, standard ad tags, consent signals and certified status. Nothing in that list is exotic. The tags were the malvertising vector, and the vendor lists were the passport.

A forthcoming second report

The Citizen Lab says a separate threat actor it calls DARK CARTOGRAPHER used Discover-Tech's infrastructure to exploit carrier "zero-click login" systems and HTTP header enrichment to link advertising IDs to phone numbers. According to the report, the issues span mobile providers in more than 30 countries, the actor has been active since at least 2019, and its infrastructure links to both a mercenary ad tech vendor and a U.S. government contractor. The researchers say they will publish details once disclosure to carriers is complete.

Reaction on LinkedIn

The report has started circulating among privacy professionals. Nicole Fink, a German data protection and cybersecurity consultant who runs 2fink Consulting, posted about it on LinkedIn about two days before October 18. "Once the ad-banner appears on screen, the damage may already be done," Fink wrote. "A study by the University of Toronto documents in detail how online adverts can infect devices." She attached a cheat sheet titled "The Ad Machine as an Attack Surface," whose contents were not included in the captured post.

Timeline

Summary

Who: The Citizen Lab at the University of Toronto, with a parallel investigation by Confiant, examined Israeli ad company Discover-Tech Ltd, spyware vendor Candiru (now Integrity Labs), and linked firms Bindecy and Intelos. Al Jazeera supplied network logs. Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi cut off Discover-Tech; Discover-Tech and Candiru did not respond.

What: According to the report, Discover-Tech bought targeted ads whose scripts called back to its servers and returned spyware code only to selected devices, a zero-click technique the researchers call AdFection. At least 45 Al Jazeera devices were targeted in 2024 and 2025. Discover-Tech's MyDSP bid on 3.77 billion impressions between March and June 2026, and ads with attacker scripts appeared in 75,373 apps and on 120,768 websites. The company had been listed by Google and IAB Europe as a certified or approved vendor since 2020.

When: The report was published on October 15, 2026. Google removed Discover-Tech in the first week of October 2026, and IAB Europe removed it from the Global Vendor List on October 8, 2026.

Where: Discover-Tech is registered in Israel. The ads ran through Google, Yandex, Vungle, Sunteng, Beeswax and Eskimi, and bids targeted IP addresses in 161 countries, with impressions recorded on government, NATO, EU and media networks.

Why: The report argues that ordinary programmatic features, individual-level targeting and code-carrying ads, combined with vendor lists the researchers say rely largely on self-attestation, let a spyware supplier operate as a certified ad buyer for almost six years. It calls for regulatory investigation, mandatory vendor audits and know-your-customer checks, and ad blocking on government networks.