AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks
Citizen Lab says Candiru used Discover-Tech ads for zero-click spyware, hitting at least 45 Al Jazeera devices.
Citizen Lab reports that Discover-Tech's MyDSP advertising platform was used to profile devices and deliver exploits without a click, and links the operation to Israeli spyware vendor Candiru, later known as Integrity Labs. From March through June 2026, MyDSP bid on 3,770,286,576 impressions and won about 441,954,291, spanning more than 120,000 websites and 70,000 apps. Network logs show at least 45 Al Jazeera devices were targeted in 2024 and 2025 with Candiru spyware delivered through those ads. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since restricted Discover-Tech's access.
- Citizen Lab links Discover-Tech ad infrastructure to Candiru, also known as Integrity Labs.
- MyDSP bid on 3.77 billion impressions and won about 442 million from March to June 2026.
- At least 45 Al Jazeera devices were targeted with ad-delivered zero-click spyware in 2024-2025.
- Ads also appeared on networks tied to the Pentagon, NATO, UN, and European Commission.
- Google cut Discover-Tech from its ad exchanges; IAB Europe suspended its vendor status.
Full article959 words · extracted from securityaffairs.com · click to collapse
Spyware vendors use online ad infrastructure to profile targets and deliver exploits without requiring users to click anything.
The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021. Candiru has since used the name Integrity Labs. Citizen Lab also identified links involving other surveillance companies, including Bindecy and Intelos, suggesting that Discover-Tech’s infrastructure served more than one customer.
The researchers examined almost four billion advertising bid records covering March to June 2026. During that period, Discover-Tech’s MyDSP platform bid on nearly 3.77 billion ad impressions and won about 442 million, with advertisements appearing across more than 120,000 websites and 70,000 mobile apps.
“We reviewed bidding data for MyDSP for four months (March through June 2026). In this period, Discover-Tech’s MyDSP bid on 3,770,286,576 impressions, and appeared to win 441,954,291 (11.7%). About 76.7% of the bids were for ad impressions in mobile apps, and 23.3% for impressions in the web browser.” reads the report published by Citizen Lab. “The database shows a total of three advertisers, with nine total combinations between advertiser and an advertiser domain name.”
Reuters, citing Citizen Lab and advertising security firm Confiant, reported that the company’s wider advertising activity reached more than 120,000 websites and 75,000 apps, potentially exposing hundreds of millions of people to its tracking infrastructure.
The distinction between exposure and infection matters. Most advertisements didn’t necessarily deliver spyware, and seeing one doesn’t prove a device was compromised. But the system gave Discover-Tech a way to profile users at scale and select particular devices for more intrusive operations.
“In 2024 and 2025, international news network Al Jazeera was targeted in a series of zero-click attacks that we link with high confidence to Candiru’s spyware delivered via Discover-Tech’s ads. At least 45 devices within Al Jazeera were targeted in these attacks.” continues the report.
Citizen Lab reached this finding by examining network logs supplied by the broadcaster. The researchers linked the activity in 2024 and 2025 to Candiru spyware delivered through Discover-Tech advertisements, providing technical evidence of a real operation rather than a theoretical attack scenario.
The advertising records also showed impressions on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission and the International Criminal Court. Researchers identified activity involving government, defense, media and critical-infrastructure networks across several countries.
These findings don’t mean that every organization whose network displayed an advertisement suffered a spyware infection. They do show that advertising infrastructure can reach people working in environments where their identities, communications and device activity have intelligence value.
This creates a problem for security teams. Traditional defenses focus on malicious attachments, suspicious links, vulnerable software and unauthorized network connections. AdFection adds another route: code delivered through a service that users and organizations routinely allow because it supports ordinary web browsing.
Advertising identifiers, IP addresses, browser characteristics and other technical signals can help operators distinguish one device from another. When combined with targeted advertising, these signals can support reconnaissance and help an operator decide which users merit further attention. In intelligence terms, the same infrastructure can support both broad collection and selective exploitation.
Discover-Tech’s access to major advertising platforms helped its operations appear legitimate. Citizen Lab found that Google and the advertising industry association IAB Europe had listed the company among approved vendors for years, despite links to people and businesses associated with the surveillance industry.
Following the investigation, Google terminated Discover-Tech’s access to its advertising exchanges, while IAB Europe suspended its vendor status. Beeswax removed the company from its platform, and Vungle, operated by Liftoff, paused its access while reviewing the findings. Eskimi also blocked its accounts and domains.
These actions matter, but they don’t resolve the underlying problem. The advertising industry relies on complex chains of buyers, exchanges, publishers and third-party scripts, often with limited visibility into what each component does when an advertisement loads. A company can pass routine checks while using targeting rules to deliver different code to different users, making malicious behavior harder to detect through automated scanning alone.
Organizations should treat online advertising as a potential attack surface, particularly on devices used by executives, intelligence personnel, journalists and employees with access to sensitive systems. Blocking advertisements and tracking requests at the network gateway can reduce exposure, while managed devices should disable ad personalization where possible and use browsers with strong tracking protections.
Security teams should also review traffic generated when advertisements load, looking for unexpected connections to external infrastructure or suspicious scripts. Organizations facing elevated targeting risks should consider stricter controls on advertising, browser extensions and third-party content, especially on systems used to access confidential information.
The larger lesson is that a familiar user experience doesn’t guarantee a safe technical process. A banner promoting a phone or a pair of earbuds may look entirely ordinary, while the code behind it performs tracking or checks whether the device matches a target. The victim doesn’t need to click anything, and that’s precisely what makes this technique difficult to spot.
“The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.” continues the report. “Two major U.S. security agencies, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have warned already in 2018 and 2020 that adversaries may leverage malicious ads to deploy malware on devices, and thus both recommended that government agencies and other organizations use ad-blocking software.”
This is the central warning from Citizen Lab’s investigation: online advertising is no longer just a privacy concern. Under the right conditions, it can become an operational tool for espionage.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, spyware)