An Israeli company that presented itself as a digital advertising firm used ordinary online ads to help commercial spyware vendors find, track and silently infect chosen targets, according to research published Thursday by the University of Toronto's Citizen Lab and ad-security firm Confiant, Reuters reported. The findings show that programmatic advertising, the automated auctions that place ads on websites and in apps, can serve as a delivery channel for spyware, which makes ad controls on corporate and government devices a security decision.

What Happened

Citizen Lab's report, "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware," describes a platform called Controlium run by Discover-Tech. Customers could pick targets by mobile advertising ID (the identifier a phone shares with ad networks), browser ID or IP address. When a targeted ad loaded, a script inside it contacted a Discover-Tech server, which returned code only to the selected devices. No tap or click was needed, and because the code went only to targets, the ad networks carrying the ads never saw it.

The researchers linked, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to spyware from Candiru, an Israeli vendor now branded Integrity Labs that the U.S. Commerce Department blacklisted in 2021. Reuters reported the devices were Windows computers and that Citizen Lab confirmed the compromises using network logs Al Jazeera shared. The report also ties a second spyware vendor, Bindecy, to Discover-Tech through platform logins and server infrastructure. Citizen Lab calls the work the first public technical confirmation of zero-click spyware delivered through targeted ads.

RelatedWest African Scam Crackdown Brings 28 Arrests and Removal of 3.7 Million Accounts, DOJ Says

Discover-Tech left nearly four billion bidding records from March to June 2026 in publicly readable databases, and an unprotected endpoint exposed 128 days of login logs for 120 usernames, the report says. In those records Citizen Lab found Discover-Tech ads in 75,373 apps and 120,768 websites. Confiant said the company served at least 10 million ads a day and that spyware delivery was a tiny fraction of that volume, according to Reuters.

Sensitive Networks, Unconfirmed Infections

Confiant found Discover-Tech ads displayed on networks of the Pentagon, the International Atomic Energy Agency and the International Criminal Court, Reuters reported. Citizen Lab found impressions on networks of NATO, the United Nations, European Union institutions, national ministries and defense bodies, and semiconductor and defense companies; Reuters named chipmakers Nvidia, Sandisk, Broadcom and Micron. Citizen Lab stresses that an ad impression "does not in and of itself confirm targeting or infection with spyware," and calls for urgent checks of those networks.

Google said it worked with the researchers and cut Discover-Tech's access to its ad exchanges for systematic policy violations. IAB Europe, an industry body, removed it from its approved-vendor list; Comcast's Beeswax removed it; Liftoff's Vungle paused its access pending review; and Eskimi blocked its accounts, telling the researchers the ad tags were built to evade automated scanning. Discover-Tech, Candiru, Bindecy and Microsoft's Xandr did not respond to Citizen Lab, and Yandex did not respond to Reuters.

Why It Matters

Most corporate defenses assume an attacker needs someone to click or open something; here a user only had to load a page or app carrying an ad. "The way online advertising works today is a systemic security threat," Citizen Lab senior researcher Wolfie Christl told Reuters.

Citizen Lab recommends that organizations block ads and tracking at the network gateway and on work devices, and that governments require ad blocking on government devices and disable advertising IDs on government phones. It also urges regulators to use sanctions and entity listings against spyware firms and the companies that enable them. The case also shows a vendor-risk gap: Discover-Tech sat on approved-vendor registries that ad buyers and sellers rely on. Reuters noted the Pentagon said earlier this year that U.S. forces in war zones had been targeted using location data gathered by ad tech firms and data brokers.

What to Watch

The report does not say which governments bought Candiru's or Bindecy's services. Citizen Lab has promised a separate report on a group it calls DARK CARTOGRAPHER, which used Discover-Tech infrastructure to link advertising IDs to phone numbers through mobile-carrier weaknesses in more than 30 countries; the report says its infrastructure links to a U.S. government contractor it did not name. Watch for regulators acting on Discover-Tech or Bindecy, for exchanges adopting the customer checks and registry audits Citizen Lab proposes, and for listed organizations reporting what their network checks find.