Discover-Tech placed nearly four billion ad bids between March and June 2026, the Citizen Lab said — a reach that the researchers tied to live, zero-click spyware infections at Al Jazeera.
How the zero-click ad attack operated
Citizen Lab investigators described an ad-delivery chain that turned ordinary online advertising into a precise screening mechanism. Each Discover-Tech ad included a tiny callback: when the ad loaded, visible or not, it quietly sent the device's advertising identifier and internet address to a Discover-Tech server. That server checked whether the device matched a target list; if it did, the server returned attack code for the browser or app to run. If it did not, the server returned nothing.
Because the ad creative itself carried no exploit, ad networks that delivered the impression had nothing overtly malicious to detect. In Al Jazeera's case the attack required no click or other user action — the hidden code ran the moment the ad loaded, sometimes out of sight in the background.
Citizen Lab recovered the spyware binary from one compromised device but did not recover the initial exploit that breaks into the browser or app. The researchers reconstructed that first step from how the operation was set up, rather than from captured exploit code.
Discover-Tech: ad placement, reach, and public record
Discover-Tech, registered in Israel in 2020 and led by chief executive Dekel Boni, presented itself as a conventional digital advertising company. Until early October, Google and the advertising trade group IAB Europe listed Discover-Tech as an approved ad vendor (a status they held from 2020 until this month, the Citizen Lab said).
Citizen Lab and Confiant, a U.S. ad-security firm that investigated alongside the lab, estimated large volumes of traffic: Citizen Lab said Discover-Tech placed nearly four billion ad bids in the March–June 2026 window and that the ads carrying the callback appeared in roughly 75,000 phone apps and 120,000 websites; Confiant put Discover-Tech's traffic at roughly 10 million ads a day.
The ads surfaced on networks belonging to NATO, the United Nations, European Union bodies, government offices in about two dozen countries, chipmakers, and news organizations. Citizen Lab noted that an ad appearing on a network is not proof of infection — only of potential reach.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCandiru linkage and recovered artifacts
The Citizen Lab linked the Al Jazeera infections to Candiru with high confidence. Al Jazeera provided traffic logs that showed a consistent sequence on infected devices: first contact with a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server that operated the spyware. Al Jazeera also pulled a Windows program file from a compromised machine; its code used the same distinctive techniques as a Candiru tool Citizen Lab dissected in 2021, forming the basis for the high-confidence attribution.
The researchers published at least one direct indicator for defenders: the SHA-256 of the recovered spyware sample is 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. They also identified a Discover-Tech ad-server domain: mtrtb[.]com, and Confiant published a fuller list of command-and-control servers and related indicators.
Citizen Lab noted that other leaked documents have described ad-based screening tools before — for example, Intellexa's Aladdin — but this report is the first public, technical confirmation that mercenary spyware reached real devices through targeted advertising.
Platform responses — Google, IAB Europe, Beeswax, Vungle, Eskimi
After Citizen Lab shared its findings, Google and IAB Europe removed Discover-Tech from their vendor lists in early October. Google told Reuters it had worked with the researchers and removed Discover-Tech "for systematically violating our policies." IAB Europe said it suspended the company "after an audit found policy violations."
On specific ad platforms, Beeswax removed Discover-Tech, Vungle paused its access pending review, and Eskimi blocked Discover-Tech accounts. Comcast, the parent company of Beeswax, said it acted "following recent activity." Discover-Tech, Candiru's owners, Al Jazeera, and the Russian ad network Yandex did not respond to Reuters; Discover-Tech's website remained online and did not comment on the findings.
What this means for technologists, policymakers, and news organizations
Technologists and security teams can use the published indicators and the connection sequence Citizen Lab identified — Discover-Tech ad server → Candiru screening server → command-and-control server — to search logs and block traffic. Citizen Lab and Confiant published the relevant web addresses and files so defenders can do that work.
Policymakers and platform regulators now have an explicit case tying commercial ad supply chains to mercenary spyware delivery; Google and IAB Europe's removals show platforms can revoke vendor access for policy violations, a step that followed the researchers' disclosures.
News organizations and other groups named in Citizen Lab's findings should note the report's cautious distinction: ad delivery on a network is evidence of reach, not proof of infection. Confiant's analysis found the ads directly tied to Candiru were low-volume and mostly reached home and mobile internet connections rather than sensitive internal networks — a technical detail that matters when triaging risk.
The Citizen Lab trace gives defenders concrete artifacts and a clear pattern to hunt for. It also raises a sharper question: how many other mercenary spyware vendors or ad intermediaries could weaponize the same callback technique before platform lists and audits catch them? The published indicators and the removal actions taken in early October provide immediate defensive steps — and a reminder that the ad ecosystem now intersects directly with national‑scale intrusion capabilities.
