Israeli digital advertising firm Discover-Tech exploited a vast commercial ad network to collect personal data and deliver mercenary spyware to targeted devices worldwide, according to an investigation published Thursday by Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.
The operation used advertising infrastructure for covert surveillance, allowing operators to identify potential targets, track their online activity and deliver spyware while evading detection. Confiant described the campaign as highly sophisticated, citing its anti-interception measures and precise targeting capabilities.
The investigation linked the operation to Israeli spyware company Candiru, which has been blacklisted by the United States and rebranded as Integrity Labs, and surveillance vendor Intelos. The companies allegedly exploited commercial advertising inventory across major platforms, including Google, Beeswax and Russia's Yandex, to track targets and compromise consumer devices.
"The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting," Confiant said in its findings.
Citizen Lab described the campaign as the first public technical confirmation of zero-click mercenary spyware delivered through online advertising, a method researchers called "AdFection."
Devices belonging to staff members at international news network Al Jazeera were among those infected through weaponized ad placements, which operated silently without visible pop-ups or suspicious links.
Discover-Tech operated a specialized system called Controlium that turned routine commercial advertising auctions into a surveillance system.
After analyzing 4 billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS devices in dozens of countries over a four-month period.
"Discover-Tech serves roughly 10 million ad impressions a day, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first-party cookies," Confiant said.
Investigators found that the ads routinely collected user session cookies, authenticated login tokens and personal identifiers directly from publisher websites, exfiltrating the data even when European Union privacy regulations prohibited processing without consent.
Citizen Lab also identified an affiliated threat actor, dubbed Dark Cartographer, that used Discover-Tech's infrastructure to exploit vulnerabilities across mobile telecommunications providers. The group matched digital advertising identities with phone numbers to identify mobile subscribers on a large scale.
Geographic data revealed sharp spikes in traffic that researchers said pointed to deliberate intelligence operations rather than ordinary commercial advertising campaigns.
Palestine emerged as the most heavily targeted territory, where Discover-Tech served nearly 2% of all digital advertisements, peaking at roughly 10% on April 7. One in every 36 Android ads in the territory originated from the firm.
Surveillance traffic also reached sensitive administrative and institutional networks, including the Armenian Prime Minister's Office, international organizations, judicial agencies, universities and defense organizations.
Investigators detected targeted connections to Candiru servers in nine countries, with Belgium accounting for 56% of observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain and other countries.
Following disclosure of the joint investigation, Google, the European advertising association IAB Europe, Beeswax, Vungle and Eskimi cut off Discover-Tech's access to their digital advertising systems.
