Citizen Lab Ties Discover-Tech Ad Network to Candiru Spyware

A powerful form of Candiru spyware was pushed through an Israeli ad agency's network to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, WIRED reported, citing Citizen Lab and ad-fraud firm Confiant.

The agency, Discover-Tech, was pumping out at least 10 million ads a day across more than 120,000 websites and 75,000 apps, the researchers said. The malicious inventory landed on "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Ads only had to load on a page for tracking to kick in; in some cases, Discover-Tech also attempted to extract phone numbers from smartphone users.

The spyware payloads were a small share of overall volume, but moved through the same plumbing: a legitimate-looking vendor plugged into the global programmatic market, able to narrow in on individuals through the same demographic and location filters any advertiser uses.

Candiru is not a new name on the sanctions map. The US Commerce Department blacklisted the firm in 2021 for allegedly supplying spyware used to target government officials, journalists, activists and academics. What is new, in the researchers' telling, is the conduit itself — ad exchanges, rather than phishing links or messaging-app zero-days.

Platforms moved quickly on the findings. Google removed Discover-Tech from its ad platforms for "systematically violating its policies," Forbes reported. IAB Europe said it suspended the firm from its global vendor list following a policy audit. Comcast's ad-tech subsidiary Beeswax also cut ties. The story sits inside a run of surveillance reporting we've been tracking over the past 90 days, but the delivery channel here is the distinguishing detail.