Israeli ad firm used ads to deliver spyware, researchers say - critical summary review

Almost every free website and app you open pays for itself the same way. The moment a page starts loading, your device enters a split-second automated auction: dozens or hundreds of companies bid for the right to show you one banner, using whatever they know about you. That profile can include details about your phone or computer, your location, your browsing history and data compiled by tracking you across the web. The process, known in the industry as real-time bidding, lasts milliseconds and happens without you noticing, on practically every ad-supported page you visit.

There is almost no regulation of this market, and privacy researchers have been warning about it for years, mostly as a data problem: murky brokers selling personal information, police forces and hostile states buying it to track people. Two reports published on the same day by Citizen Lab, a digital investigations unit at the University of Toronto, and Confiant, a New York ad-security firm, say the same machinery was used for something else. According to the researchers, an Israeli advertising agency built a pipeline that let spyware companies pick out individual people from that auction traffic and infect their devices through the ad itself.

How an ad can become an attack

A "zero-click" attack is one that needs nothing from the victim: no link clicked, no file opened, no mistake made. These are rare and highly prized by attackers, and in recent years they have usually relied on flaws in mobile messaging apps. What Citizen Lab describes, in a campaign it has named "AdFection", is the merging of that technique with the ad ecosystem.

The company at the centre is Discover-Tech, founded in 2020 and presenting itself as a specialised digital advertising agency. Citizen Lab says it operates a platform called Controlium that allows its clients to profile and de-anonymise internet users at scale, fingerprint their devices and then hack a chosen target. A user shown an apparently ordinary ad, for a mobile game, a phone, a pair of headphones or a telecoms service, can have their identity and IP address harvested; the ad merely has to load on the page. Clients could select someone for profiling or infection using their IP address, their mobile advertising ID or their browser identifier, according to the investigation. If a person was picked as a target, a spyware firm could push malicious code to the device.

"Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all," said Bill Marczak, a senior researcher at Citizen Lab, quoted in the reports and in coverage of them. The infections, Citizen Lab says, happen in seconds and without the user's knowledge.

One of the firms Discover-Tech worked with, according to both research groups, is Candiru, an Israeli spyware developer placed on a US blacklist by the Commerce Department in 2021 for allegedly supplying spyware used to target government officials, journalists, activists and academics. Citizen Lab says the spyware it facilitates can reach everything on a device: messages, photos and emails, call recordings, and the microphone.

What researchers found at Al Jazeera, and how far the ads reached

The strongest evidence comes from one newsroom. Citizen Lab concluded that during 2024 and 2025, a powerful version of Candiru's spyware, delivered through Discover-Tech ads, was used against 45 Windows devices at the Qatari broadcaster Al Jazeera. The researchers could establish this because Al Jazeera took part in the investigation and handed over its network logs, which showed infected devices contacting Discover-Tech-linked domains and then connecting to infrastructure associated with Candiru. Al Jazeera did not respond to requests for comment from news outlets covering the reports.

The wider reach is a separate question, and the researchers are careful about it. Not all of the company's ads were weaponised: Confiant said the Candiru-linked ads were a tiny fraction of total volume. But the volume itself is large. Jerome Dangu, co-founder of Confiant, said Discover-Tech was serving at least 10 million ads a day worldwide, and that data-sharing deals known as "cookie matching" let it track people beyond the reach of its own ads. "It is very likely that hundreds of millions of people were affected," he said.

By analysing ad-bidding records left publicly exposed on Discover-Tech's own website, Citizen Lab found ads carrying attacker script tags running in more than 120,000 websites and more than 70,000 mobile apps between March and June of this year. Both groups say the ads were served on networks belonging to government and national-security bodies: NATO, the United Nations, the European Commission, the International Criminal Court, the International Atomic Energy Agency, the Pentagon, lawmaking bodies in Europe, armed forces and agencies in Norway and Sweden, critical infrastructure providers in Australia, and more than a dozen national governments. Chipmakers including Nvidia, SanDisk, Broadcom and Micron appeared on the list, as did unnamed media organisations in Mexico, Israel and Europe. Dangu said some regions were saturated: "You go to pretty much any website in Palestine, any website, and you find a Discover-Tech ad."

Platforms cut the company off

Discover-Tech reached users through major ad platforms, including those operated by Google, Comcast and Russia's Yandex. Three of those relationships have now been severed or suspended.

Google said that after a joint investigation with Citizen Lab and Confiant it blocked the company from its ad platforms "for systematically violating our policies", and set up Safe Browsing warnings for people who navigate to sites linked to the group. Beeswax, Comcast's ad-tech subsidiary, said it removed Discover-Tech from its platform following recent activity and independent validation by a third-party security specialist, adding that it has a zero-tolerance policy for malicious advertising. IAB Europe, the European branch of the Interactive Advertising Bureau, an industry body, confirmed it suspended the company from its global vendor list after an audit found policy breaches, and said further confirmation of the spyware findings could justify a permanent expulsion.

Discover-Tech did not respond to messages sent through its contact form, or to emails and messages sent to its chief executive, Dekel Boni. Yandex did not respond to requests for comment. Attempts to reach Candiru's owners were unsuccessful, and Integrity Partners, believed to hold Candiru's assets after the 2021 sanctions, also did not reply.

Why researchers say the problem is the system, not one company

Both research groups frame this as a structural failure rather than a single bad vendor. "It's disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company's malicious advertising operations for years," said Wolfie Christl, a senior researcher at Citizen Lab. "The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike."

Marczak argued the underlying design is what makes abuse possible: the ability to push individualised content to specific users is the normal function of the modern ad market, and, in his words, until that architecture changes or ad companies take customer vetting seriously, this kind of abuse will keep happening. He also offered a reason why such campaigns have rarely surfaced before: Al Jazeera's network logs were what made the ad-based nature of the attack visible, and a person targeted on home Wi-Fi or mobile data would have no comparable monitoring.

The context around it is already building. Earlier this year the Pentagon said it had received reports that US forces deployed to war zones were targeted using location data gathered by ad-tech companies and data brokers; branches of the armed forces have since disabled ad tracking on some devices. In the United States, immigration enforcement and other agencies have bought software that uses ad-tech data to track people's movements.

What to do with this information

The first thing to watch is institutional. Christl said cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions "must urgently step in", investigate the companies involved and fix the systemic risks that enable malicious ad targeting. Whether any formal investigation opens, and whether IAB Europe converts its suspension into a permanent expulsion once it reviews the spyware findings, are concrete, checkable outcomes. The second is commercial: Google, Beeswax and IAB Europe have acted, while other platforms that carried the same ads have not said publicly what they found.

For individuals, the researchers' advice is narrow and blunt, because the attack requires nothing from the victim. Citizen Lab and Confiant recommend that people at elevated risk of targeting block ads as thoroughly as possible across websites and apps, disable ad tracking on their devices, and reset their mobile advertising ID regularly. Marczak notes there is not much else a person can do against an attack that needs no click, which is part of why the researchers direct most of their demands at platforms and regulators rather than at users.

Knowing that a loaded ad can carry more than an ad, which of the sites and apps you use every day would you actually be willing to turn advertising off in?