How a Dodgy Israeli Ad Firm Became a Zero-Click Spyware Delivery Machine
Citizen Lab has published findings that should make anyone who runs online ads deeply uncomfortable. An Israeli advertising company called Discover-Tech appears to have been operating as a front for a spyware delivery operation, using the entirely mundane machinery of digital advertising to fingerprint, track, and silently infect targets with commercial spyware.
The campaign, which Citizen Lab is calling AdFection, exploited the real-time bidding ecosystem that underpins virtually all programmatic advertising. Every time a webpage or app loads an ad, a lightning-fast auction takes place in which advertisers bid for the right to show you something. In exchange, the winning bidder gets a firehose of device and user data. Discover-Tech apparently decided that data was just the starting point.
The company's Controlium platform went well beyond standard ad tracking. According to Citizen Lab, it could de-anonymize users at scale, build detailed device fingerprints, and in some cases deliver zero-click exploits when an ad loaded on a target's screen. No interaction required. The ad simply appears and the infection begins.
The confirmed spyware in question is Candiru, an Israeli mercenary spyware vendor with a history of turning up in places it shouldn't. Between 2024 and 2025, Citizen Lab identified at least 45 devices belonging to Al Jazeera staff that were targeted through AdFection attacks delivering Candiru's payload.
The scale of Discover-Tech's operation is hard to overstate. A server left exposed by the company contained four billion ad bid records. Its ads appeared across nearly 200,000 unique websites and mobile apps globally. The reach wasn't incidental, it was the point.
Discover-Tech wasn't working alone either. Citizen Lab also identified connections to another actor it calls Dark Cartographer, which has been building databases that link mobile advertising identifiers to phone numbers by exploiting weaknesses in mobile carrier infrastructure. Mass de-anonymization as a service, essentially.
The advertising industry has made some moves. Google and IAB Europe removed Discover-Tech from their vendor registries. Google blocked the firm's access to its ad exchange. Beeswax and Eskimi followed. Whether that's enough to dismantle the infrastructure is a different question.
Citizen Lab's recommendation is blunt: block targeted ads at the gateway until the advertising industry can actually demonstrate it can reliably prevent this kind of abuse. Given that the entire RTB ecosystem is built around sharing user data with thousands of unknown bidders simultaneously, that demonstration may be some time coming.