wired.com web signal

Citizen Lab Ties Discover-Tech Ad Network to Candiru Spyware

By Published Updated
8 sources tracking this story
Cybersecurity Surveillance ai-business

TL;DR

  • Citizen Lab and Confiant confirmed 45 Al Jazeera devices were compromised in 2024-2025 via zero-click Candiru spyware routed through Discover-Tech's Controlium platform.
  • Discover-Tech's MyDSP placed 3.77 billion ad bids across 120,768 websites and 75,373 apps in 161 countries between March and June 2026.
  • Google, IAB Europe, Beeswax, and Eskimi cut off Discover-Tech only after Citizen Lab shared findings; no platform detected the operation through its own monitoring.

A powerful form of Candiru spyware was pushed through an Israeli ad agency's network to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, WIRED reported, citing Citizen Lab and ad-fraud firm Confiant.

The agency, Discover-Tech, was pumping out at least 10 million ads a day across more than 120,000 websites and 75,000 apps, the researchers said. The malicious inventory landed on "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Ads only had to load on a page for tracking to kick in; in some cases, Discover-Tech also attempted to extract phone numbers from smartphone users.

The spyware payloads were a small share of overall volume, but moved through the same plumbing: a legitimate-looking vendor plugged into the global programmatic market, able to narrow in on individuals through the same demographic and location filters any advertiser uses.

Candiru is not a new name on the sanctions map. The US Commerce Department blacklisted the firm in 2021 for allegedly supplying spyware used to target government officials, journalists, activists and academics. What is new, in the researchers' telling, is the conduit itself — ad exchanges, rather than phishing links or messaging-app zero-days.

Platforms moved quickly on the findings. Google removed Discover-Tech from its ad platforms for "systematically violating its policies," Forbes reported. IAB Europe said it suspended the firm from its global vendor list following a policy audit. Comcast's ad-tech subsidiary Beeswax also cut ties. The story sits inside a run of surveillance reporting we've been tracking over the past 90 days, but the delivery channel here is the distinguishing detail.

What others are reporting

Coverage cluster as of 24h after publish

  1. Citizen Lab Read →

    Primary research report: forensic analysis of 4 billion bidding records and full technical breakdown of Controlium delivery architecture, including evidence of the first-ever zero-click spyware-via-ad attack.

    "This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads."
  2. CyberScoop Read →

    Highlights ad vendors' systemic failure to detect the operation for years and reports overlap between Discover-Tech vendor ties and U.S. government contractors via DARK CARTOGRAPHER.

    "Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike."
  3. The Record Read →

    Leads with national-security infrastructure targeting: NATO, U.S. DoD, IAEA, and ICC networks; frames the story as a systemic regulatory failure in ad-tech vetting.

    "The ads 'covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance,' the report said."
  4. The Hacker News Read →

    Emphasizes global operational scale across 4 billion bids, 75,000 apps, and 120,000 websites, and surfaces actionable IOCs and defensive indicators for security teams.

    "The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background."
  5. Security Affairs Read →

    Technical depth on programmatic ad infrastructure: details the complex chains of buyers, exchanges, publishers, and third-party scripts that made detection structurally impossible.

    "The victim doesn't need to click anything, and that's precisely what makes this technique difficult to spot."
  6. Hackread Read →

    Detailed breakdown of Controlium targeting mechanics via IP addresses and advertising IDs, plus practical mitigation guidance oriented toward organizational security teams.

    "Online advertisements requiring no clicks were used to deliver mercenary spyware to devices at Al Jazeera."
  7. CyberInsider Read →

    Focuses on evasion: how Discover-Tech's selective JavaScript delivery bypassed ad security scanners, and why the attack surface remains unmonitored across the industry.

    "A normal-looking ad loads. If you're a target, you're infected. No click needed."

Shared on Bluesky by 2 AI experts

Originally reported by wired.com

Read the original article →

Original headline: Citizen Lab Exposes Israeli Ad Firm Discover-Tech Routing Al Jazeera and UN Targets to Candiru Spyware