“We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse.” — Citizen Lab
Discover-Tech and the Controlium platform
Researchers at Citizen Lab name an Israeli adtech firm, Discover-Tech, as the central actor in a newly documented abuse campaign. According to Citizen Lab, Discover-Tech operates a platform called Controlium that sat inside the normal programmatic advertising supply chain and exploited the real-time bidding process that decides which ads appear on websites and in apps.
Citizen Lab found Discover-Tech placed ads across a vast surface: more than 70,000 mobile apps and 120,000 websites between March and June 2026, after analyzing nearly four billion ad-bidding records. Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020, records show, which Citizen Lab says allowed the company to access advertising exchanges and buyer streams without apparent detection of the alleged abuse.
AdFection: zero-click exploitation through targeted ads
Citizen Lab calls the technique "AdFection." In this model, simply loading a page or app can be enough to trigger a zero-click exploit — no link to click, no file to download. The researchers say Controlium used the information exposed during real-time bidding (device and location data supplied during auction) to identify specific targets and serve them malicious ad creative tailored to deliver spyware.
The operation also, the researchers assert, covertly directed millions of devices toward servers associated with the spyware vendor Candiru. Citizen Lab is careful to note that those redirected connections do not necessarily prove a successful infection, but they are part of the observable footprint tied to Discover-Tech's activity.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCandiru (Integrity Labs) and infections at Al Jazeera
Citizen Lab traced attacks delivered via Discover-Tech ads to at least 45 devices at Al Jazeera during 2024 and 2025. The spyware vendor linked to those attacks is Candiru, the Israeli developer now known as Integrity Labs. Researchers concluded that at least some of the devices were successfully targeted with Candiru spyware after arriving via ad-based delivery pathways.
That tracing — linking Controlium ad traffic to Candiru-associated infrastructure and to targeted devices at a named media organization — is the basis for Citizen Lab's claim that the advertising ecosystem was being used as a delivery mechanism for mercenary spyware.
Responses from ad platforms and industry lists
Once Citizen Lab published its findings, commercial and standards actors moved quickly. Google terminated Discover-Tech’s access to its advertising exchanges and removed the company from its approved vendor lists. IAB Europe likewise removed Discover-Tech from approvals, and several ad platforms — Beeswax, Vungle and Eskimi — also took action against the firm. Citizen Lab reports that Discover-Tech and Candiru did not respond to requests for comment, and the researchers say Discover-Tech appears to have operated as a middleman between the advertising ecosystem and multiple spyware and hacking vendors.
What this means for technologists, policymakers, and media organizations
- Technologists and security teams: Citizen Lab’s analysis shows a pathway where programmatic ad metadata (device and location attributes exposed in bidding) can be used to profile and select targets. Teams responsible for app and web platforms will need to consider how ad bidding data flows into client-side contexts and how to detect anomalous ad creative or redirect behavior.
- Policymakers and standards bodies: The discovery that a vendor listed on industry-approved lists since 2020 could allegedly serve as a conduit to mercenary spyware underscores the regulatory and vetting implications of vendor lists and exchange access. Citizen Lab frames the case as exposing "structural flaws" in the online advertising system.
- Media organizations and high-value targets: Citizen Lab’s tracing of at least 45 devices at Al Jazeera to Candiru via ad delivery highlights that journalistic and organizational targets can be reached through programmatic channels that traditionally are not treated as direct attack vectors.
Citizen Lab’s report reframes a long-running complaint about targeted ads — that they know too much about people — into a darker charge: that advertising systems can be, and were, used to deliver zero-click spyware at scale. Platforms and trade bodies have already rescinded Discover-Tech’s approvals, but the technical trace-ability found in nearly four billion bid records raises a pointed question the public will now ask: if a vendor could reach across 70,000 apps and 120,000 sites before being removed, how will the ad ecosystem prevent the next AdFection-style operation?
