Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Discover-Tech used its Controlium platform to serve ads embedded with malicious scripts that fingerprinted devices and executed zero-click spyware infections on behalf of Candiru, an Israeli spyware vendor. The ads collected advertising IDs and other identifiers to profile users and selectively infect targets. Citizen Lab's investigation revealed that Discover-Tech's ads appeared on nearly 200,000 websites and mobile applications globally, exposing billions of ad bid records. The campaign targeted at least 45 devices within Al Jazeera between 2024 and 2025. The operation leveraged the real-time bidding ad ecosystem to deliver spyware infections at scale, effectively bridging ad vendors and mercenary spyware actors. Industry responses included removal from ad vendor registries and blocking by major ad platforms.

The campaign enabled large-scale de-anonymization, device fingerprinting, and zero-click spyware infections, compromising user privacy and security globally. Targeted organizations, such as Al Jazeera, suffered direct infections. The widespread presence of Discover-Tech ads across numerous websites and apps increased the risk of exposure to spyware infections. The operation facilitated persistent tracking and surveillance by threat actors, undermining user anonymity and security.

Google, IAB Europe, Beeswax, and Eskimi have removed or blocked Discover-Tech from their ad exchange platforms, effectively disrupting the campaign's infrastructure. Citizen Lab advises defenders to block targeted ads at the network gateway as the most feasible protection measure until the advertising industry can reliably block all AdFection-style attack vectors. No official patches apply as this is an abuse of the advertising ecosystem rather than a software vulnerability.