Citizen Lab: Discover-Tech Ad Platform Delivered Spyware to Al Jazeera
Researchers say an Israeli adtech firm acted as a middleman, using real-time bidding to infect devices with mercenary spyware without user interaction.
Key points
- Citizen Lab researchers identified "AdFection," a zero-click spyware delivery method using targeted online ads.
- Israeli firm Discover-Tech allegedly served as a bridge between advertisers and spyware vendors like Candiru.
- At least 45 devices at Al Jazeera were infected with Candiru spyware via this method in 2024 and 2025.
Citizen Lab researchers have uncovered a novel espionage technique that uses online advertising networks to deliver zero-click mercenary spyware. According to the security lab, Israeli adtech firm Discover-Tech facilitated these attacks by acting as a middleman between the advertising industry and hacking vendors.
The technique, dubbed "AdFection," allows attackers to infect devices simply when users open a website or application. This method bypasses the need for victims to click suspicious links or download files. Citizen Lab states this is the first publicly confirmed case of such an attack being delivered through targeted ads.
How the AdFection Method Works
Discover-Tech’s Controlium platform reportedly exploited the real-time bidding system used to determine which ads appear on digital properties. Every time a user loads a page, advertisers compete for ad space and receive data about the device and location.
Researchers allege Discover-Tech used this bidding data to identify specific targets and serve them malicious advertisements. The company purported to be a legitimate advertising business, but Citizen Lab says it appears to be a front for large-scale ad espionage abuse.
Affected Targets and Vendors
One spyware vendor linked to this operation is Candiru, an Israeli developer now known as Integrity Labs. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware.
These infections were delivered through ads served by Discover-Tech. The researchers argue that serving as a bridge between advertisers and spyware vendors appears to be Discover-Tech’s primary purpose, rather than legitimate ad distribution.
What should you do?
Security professionals should monitor for unusual ad network traffic and investigate any unexpected device behavior following page loads. Organizations should review their ad-tech supply chains for unknown intermediaries. No patch has been confirmed for this specific delivery mechanism yet.
What to do and how to stay safe: Discover-Tech
- Audit ad-tech vendors and supply chains to identify unknown intermediaries like Discover-Tech.
- Monitor network logs for suspicious real-time bidding traffic or unexpected outbound connections.
- Implement strict browser security policies to limit ad script execution on sensitive networks.
- Train staff to recognize that zero-click attacks can occur without any user interaction or downloads.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a spyware delivery technique that uses targeted online ads to infect devices without requiring user clicks or downloads.
Which company is accused of facilitating these attacks?
Israeli adtech firm Discover-Tech is accused of acting as a middleman between advertisers and spyware vendors.
Who were the confirmed victims of this specific campaign?
Citizen Lab confirmed that at least 45 devices at Al Jazeera were infected with Candiru spyware via this method.
