Ad-tech firm Discover-Tech used targeted ads to deliver spyware, researchers say
- Researchers say Discover-Tech used online ads to track users and help deliver zero-click spyware.
- Its ads appeared across more than 120,000 websites and over 70,000 apps worldwide.
- Citizen Lab linked the system to Candiru attacks targeting at least 45 Al Jazeera devices.
Israeli advertising firm Discover-Tech used ordinary online ads to track people and install spyware to their devices, as per Reuters.
It was able to distribute ads across a vast network of websites and apps using advertising platforms operated by Google, Comcast and Yandex. Independent investigations by Citizen Lab and Confiant revealed how the operation worked. Simply loading an ad could expose users to surveillance or spyware, even without clicking on it.
Why a loaded ad was enough to compromise a device
Real-time bidding auctions ad space in milliseconds, sharing device and location data with potential buyers. Some ads also run code. Citizen Lab calls the zero-click spyware technique AdFection and links Discover-Tech to Candiru, an Israeli spyware maker blacklisted by the US in 2021.
On April 12, 2026, Confiant found a MyIPInfo banner, which redirected to an infrastructure linked to Candiru through Amazon CloudFront. The ad loaded a fake verification tool that have about 90KB of hidden JavaScript. This allowed it to collect information about the device and communicate through an encrypted channel. Confiant investigated the activity between April and September 2026.
45 infected machines at Al Jazeera, millions more exposed
Citizen Lab examined four billion bidding records. It found out that Discover-Tech had booked its advertisements on at least 120,000 online sites and in 75,000 applications.
As per Confiant’s estimation, there are at least 10 million advertisements delivered via Discover-Tech in a day. Its cofounder Jerome Dangu said “very likely hundreds of millions of people would have been touched by Discover-Tech.”
Citizen Lab confirmed that Candiru spyware compromised 45 Windows machines at Al Jazeera during 2024–2025. The broadcaster said it “condemns the spyware attacks targeting a number of its staff.”
Discover-Tech ads are also shown on networks associated with government and international agencies, including the Pentagon, United Nations, NATO, European Commission, International Atomic Energy Agency and International Criminal Court. Researchers also detected Discover-Tech ads on networks associated with chipmakers Nvidia, Broadcom and Micron.
However, exposure does not necessarily mean infection. Unlike the reported compromises at Al Jazeera, these appearances do not establish that spyware successfully infected devices at those institutions.
Google, IAB Europe and Beeswax cut off access
Google removed Discover-Tech from its advertising platform “for systematically violating our policies.” IAB Europe also dropped the ads company from its list of approved vendors. Comcast’s Beeswax blocked its access to the platform.
The findings raised wider concerns about online advertising security. Citizen Lab researcher Wolfie Christl warned that “the way online advertising works today is a systemic security threat.”
A $1.34 trillion market built on the same plumbing
The advertising market continues to grow, raising the stakes for security. WARC expects global ad spending to reach $1.34 trillion in 2026. In the US, programmatic advertising earned a staggering $162.4 billion in 2025 according to IAB numbers. But security measures have been unable to keep up with the increasing application of artificial intelligence in the advertising industry.
IAB research shows only about 40% of the surveyed ad buyers have already done or plan to do something regarding legal, security, and data risks related to AI-powered measurement.
Norway recently fined Microsoft-owned Xandr NOK 92 million for unlawfully sharing sensitive Grindr data through ad auctions. It was a privacy violation, not a spyware case. Regulator Line Coll said responsibility “cannot be passed on to others.”
The Discover-Tech case comes as advertising companies are increasingly investing in consumer data and AI-powered targeting. As Cryptopolitan previously reported, Publicis Groupe signed an agreement to buy LiveRamp for $2.2 billion, thus enhancing its AI-based marketing activities.
While the deal has no connection to the spyware attacks, it shows how important data and automation have become to the industry. The findings also raise questions about whether existing security measures are keeping pace.
Citizen Lab has called for investigations into Discover-Tech and Candiru, putting pressure on advertising platforms to improve how they screen vendors and detect malicious ads.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What is AdFection and how does it work?
AdFection is the name Citizen Lab gives to zero-click spyware delivered through targeted online ads. The ad only has to load; code inside it fingerprints the device and can open a channel to install spyware, exploiting the real-time bidding auction that decides which ad a user sees.
How many people were actually infected versus exposed?
The confirmed infections are narrow: Citizen Lab verified 45 Windows machines compromised at Al Jazeera between 2024 and 2025. The far larger figures, such as Confiant's estimate of hundreds of millions of people "touched," refer to ad exposure and tracking, not device infections.
What have advertising platforms done in response?
Google removed Discover-Tech "for systematically violating our policies," IAB Europe dropped it from its approved-vendor list after an audit, and Comcast's Beeswax subsidiary cut off access, according to Reuters. Yandex did not respond to Reuters' requests for comment.
Micah Abiodun
Micah Abiodun makes good use of his Environmental Engineering and Management (MSc) at Tallinn University of Technology (TalTech) to polish content and price prediction news at Cryptopolitan. Now on his 7th year in the crypto media space, he covers major cryptos, altcoins, DeFi, stablecoins, macro trends, and emerging tech.
