"Digital advertising is broken," Wolfie Cristl, senior researcher at The Citizen Lab, said, and the group's new technical findings show exactly how.
Discover-Tech, Controlium and the mechanics of AdFection
The Citizen Lab at the University of Toronto says it has documented a campaign it calls "AdFection" in which an Israeli-registered firm, Discover‑Tech, operates as a front for mercenary spyware distribution. According to the report, Discover‑Tech runs a platform called Controlium that "enables its mercenary surveillance partners to de‑anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered."
The researchers say Controlium covertly directs millions of devices to contact servers operated by mercenary spyware firms. Discover‑Tech was registered in 2020 and, the report states, has facilitated mercenary spyware since at least 2024.
Candiru infections and the Al Jazeera impact
The Citizen Lab links AdFection activity with high confidence to infections at media outlet Al Jazeera, finding that at least 45 devices there were targeted in zero‑click attacks tied to Candiru spyware delivered through Discover‑Tech ads. The report notes Candiru's tooling can "take over a device remotely, steal data from it, access its microphone and camera, and more."
The report emphasizes this is the first technical demonstration tying zero‑click spyware infections to targeted online advertising, rather than earlier, less technically detailed accounts.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadOther mercenary partners: Bindecy, Intelos, and DARK CARTOGRAPHER
In addition to Candiru, the Citizen Lab says Discover‑Tech has connections to another mercenary hacking firm, Bindecy, and a mercenary ad intelligence firm, Intelos. The researchers also identified a broader set of activity under the label DARK CARTOGRAPHER.
DARK CARTOGRAPHER, the report states, "is using Discover‑Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass‑deanonymizing internet users." The report adds that DARK CARTOGRAPHER infrastructure links to both "a mercenary adtech vendor and a U.S. government contractor" and calls that overlap unusual: "It is rare to see such direct overlaps between mercenary vendors and U.S. government or intelligence contractors."
The Citizen Lab said it will detail its findings on DARK CARTOGRAPHER in a separate forthcoming report.
Ad placement scale and appearances on sensitive networks
Partner investigators at ad security firm Confiant furnished reach figures cited by the Citizen Lab: between March and June of this year, Discover‑Tech ads were displayed across more than 120,000 websites and over 70,000 mobile apps. Confiant reported those placements included sensitive networks, naming the U.S. Department of Defense, NATO, the International Atomic Energy Agency and "world cybersecurity agencies" among locations where Discover‑Tech ads appeared.
Jerome Dangu, Confiant's chief technology officer and co‑founder, said the adtech ecosystem had optimized defenses against financially motivated malware but not against surveillance: "The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance."
Industry actions and calls for regulatory scrutiny
The Citizen Lab said it could not currently attribute AdFection attacks to any specific party beyond the mercenary vendors and infrastructure it documents. Discover‑Tech, Candiru, Bindecy and Intelos did not respond to the researchers' letters seeking comment, the report notes.
Following publication of the findings, Google removed Discover‑Tech from its vendor registries and ended the company's access to Google ad platforms, and IAB Europe removed Discover‑Tech from its global vendor list. The Citizen Lab called on cybersecurity agencies, regulators and lawmakers in the U.S., Europe and other regions to "urgently step in," investigate the involved companies and "fix the systemic risks that enable malicious ad targeting."
What this means for technologists, policymakers, and media organizations
- Technologists and security teams: The report documents a new delivery vector—ads that render and trigger infection—and shows that ad vendors and platforms can be leveraged to link advertising identifiers to phone numbers and to automatically execute exploits when an ad is displayed.
- Policymakers and regulators: The Citizen Lab and Confiant explicitly call for investigations and sanctions; regulators are now positioned to examine vendor certification lists and the controls that allowed Discover‑Tech to appear on Google and IAB Europe registries.
- Media organizations and other targeted networks: The Al Jazeera findings provide a concrete case that editorial and corporate networks can be impacted by targeted advertising pipelines and should account for ad rendering as a threat surface.
The Citizen Lab's technical demonstration reframes a familiar problem: the advertising pipeline itself can be weaponized for surveillance at scale. Google and IAB Europe have taken immediate, specific steps to remove Discover‑Tech from their vendor lists, and the Citizen Lab has signaled further disclosures on DARK CARTOGRAPHER. Regulators and defenders now face a clear, evidence‑based task: trace these adtech supply chains, hold accountable the vendors who facilitated exploitation, and decide what changes in certification, procurement and platform controls are required to prevent ads from becoming automatic infection vectors.
