Discover-Tech (Organization): news timeline & CVEs

No click required: How the ad industry became a pipeline for mercenary spyware

Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.

The Citizen Lab says Discover-Tech used its Controlium advertising platform, described as AdFection, to win real-time ad auctions, fingerprint devices, and silently deliver exploit code when an ad rendered. Over four months its ads appeared on about 120,768 websites and in 75,373 apps, including impressions on networks associated with NATO and major technology companies; an impression alone is not an infection. Israeli mercenary-spyware vendor Candiru used the path to infect devices at Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi removed Discover-Tech’s access after disclosure.

CSO Onlineupdated Oct 16, 17:20 UTC · 10h agofirst Oct 16, 01:02 UTC · 1d agoMalware in the wild 12 sources1· 1 read

Targeted ads delivered 0-click exploits to install mercenary malware

Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.

Citizen Lab reported the AdFection campaign, in which Discover-Tech served targeted ads that delivered zero-click exploits and installed mercenary spyware from Candiru, also known as Integrity Labs. Ad code contacted Candiru servers, which returned an exploit and payload when the ad rendered. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since removed, paused, or blocked Discover-Tech. Impressions appeared on networks linked to NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure, and Norwegian and Swedish government and military agencies. The report does not name the vulnerabilities or the final malware.

Ars Technica · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 20:32 UTC · 1d agoThreat actor in the wild 12 sources

Zero-click spyware infecting devices through online ads, researchers say

Citizen Lab says Candiru used Discover-Tech ads to zero-click infect Al Jazeera journalists and reach sensitive government networks.

Citizen Lab and Confiant say Israeli ad firm Discover-Tech used its Controlium platform to deliver zero-click spyware through online ads. The ads infected devices of at least 45 Al Jazeera journalists and were rendered on sensitive networks including NATO, the U.S. Department of Defense, Estonia’s RIA, the IAEA, and the ICC. Candiru allegedly hired Discover-Tech; the ads sent millions of devices to Candiru servers and the spyware can record calls, enable microphones, and steal messages. Researchers reviewed four billion placement records, and Google and other platforms have since blocked Discover-Tech.

The Recordupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 19:00 UTC · 1d agoThreat actor in the wild 12 sources2

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

Citizen Lab says Candiru spyware hit at least 45 Al Jazeera devices via zero-click ads.

The Citizen Lab reported that Israeli spyware maker Candiru infected Al Jazeera devices through online ads that ran without a click. Discover-Tech ads sent advertising IDs and IP addresses to a server that returned browser or app exploit code only for chosen targets. At least 45 devices were targeted in 2024 and 2025, and a recovered Windows sample matched Candiru tooling analyzed in 2021. Google, IAB Europe, and other ad platforms later removed or blocked Discover-Tech.

The Hacker Newsupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 16:01 UTC · 1d agoMalware in the wild 12 sources2· 1 read

Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click

Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click malicious online ads called AdFection.

Citizen Lab reported the first public case of zero-click mercenary spyware delivered through targeted online ads, a technique it calls AdFection. With high confidence it linked 2024-2025 attacks on at least 45 Al Jazeera devices to Candiru, now rebranded Integrity Labs, using ads bought by Israeli firm Discover-Tech. Malicious ad code returned exploit JavaScript only to selected identifiers, then devices contacted Candiru validator and command-and-control servers including fearevolve[.]com and jobmarcher[.]com. A recovered Windows DLL persisted via COM hijack; Google and ad platforms have since cut Discover-Tech off.

GBHackersupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:51 UTC · 1d agoThreat actor in the wild 12 sources3· 2 reads

Spyware vendors found a way to make targeted ads even worse

Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware that infected Al Jazeera devices.

Citizen Lab reports the first publicly confirmed zero-click mercenary spyware attacks delivered through online advertising, a technique it calls AdFection. Israel-based Discover-Tech allegedly used its Controlium real-time bidding platform, approved by Google and IAB Europe since 2020, to identify targets and serve malicious ads. At least 45 Al Jazeera devices were infected in 2024 and 2025 with spyware from Candiru, now known as Integrity Labs. Discover-Tech ads appeared across more than 70,000 apps and 120,000 websites, including government, defense, and NATO networks, although infections there were not confirmed; Google and other ad platforms have since cut off the company.

The Register · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:31 UTC · 1d agoThreat actor in the wild 12 sources

AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks

Citizen Lab says Candiru used Discover-Tech ads for zero-click spyware, hitting at least 45 Al Jazeera devices.

Citizen Lab reports that Discover-Tech's MyDSP advertising platform was used to profile devices and deliver exploits without a click, and links the operation to Israeli spyware vendor Candiru, later known as Integrity Labs. From March through June 2026, MyDSP bid on 3,770,286,576 impressions and won about 441,954,291, spanning more than 120,000 websites and 70,000 apps. Network logs show at least 45 Al Jazeera devices were targeted in 2024 and 2025 with Candiru spyware delivered through those ads. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since restricted Discover-Tech's access.

Security Affairsupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:21 UTC · 1d agoThreat actor in the wild 12 sources2

Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal

Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click code hidden in online advertisements.

Citizen Lab published what it calls the first public technical proof of zero-click mercenary spyware delivered through targeted ads, a method it named AdFection. At least 45 Al Jazeera devices were targeted in 2024 and 2025 with spyware linked to Israeli vendor Candiru, now Integrity Labs. Discover-Tech's Controlium platform matched advertising IDs, cookies, or IP addresses and could return JavaScript that started infection after an ad loaded. Investigators tied a recovered Windows DLL to Candiru; it used COM hijacking and a 48-byte repeating XOR routine. After notification, Google and several ad platforms removed or suspended Discover-Tech.

Cyber Security Newsupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:16 UTC · 1d agoThreat actor in the wild 12 sources

Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.

Citizen Lab says Israeli firm Discover-Tech let mercenary spyware makers use its Controlium advertising platform to deliver malicious ads. At least Candiru and Bindecy used the platform, and Candiru’s zero-click spyware infected at least 45 Al Jazeera Windows computers in 2024 and 2025. Researchers recovered exposed dashboard code, login records, and billions of bidding records showing ads displayed across apps and sites from March to June 2026, including devices tied to militaries, governments, and critical infrastructure. Confiant also saw potentially malicious ads on International Atomic Energy Agency and International Criminal Court networks, though infection there is unconfirmed.

TechCrunch · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 10:00 UTC · 1d agoThreat actor in the wild 12 sources

Discover-Tech

Timeline9 articles

Appears with