Israeli digital advertising firm Discover-Tech allegedly weaponized a massive commercial ad network to harvest personal data and deliver mercenary spyware to targeted devices worldwide, according to a report released Thursday by Canadian cyber watchdog Citizen Lab and New York‑based ad security firm Confiant, as cited by Anadolu.
“The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti‑interception measures, and surgical micro‑targeting,” Confiant said in its investigative findings.
The coordinated operation allowed the US‑blacklisted Israeli spyware company Candiru, now operating under the name Integrity Labs, together with surveillance vendor Intelos, to exploit commercial ad inventory on major global platforms—including Google, Beeswax, and Russia’s Yandex—to track targets and compromise consumer devices.
Citizen Lab described the campaign as the first publicly disclosed technical confirmation of zero‑click mercenary spyware delivered via online advertising—a method researchers have dubbed “AdFection.”
Devices belonging to staff at the international news network Al Jazeera were among those infected through the weaponized ad placements, which operated silently without visible pop‑ups or suspicious links.
– Global identity graph, data harvesting
Discover-Tech ran a specialized system called Controlium that transformed routine commercial advertising auctions into a vast surveillance apparatus. After analyzing four billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS in dozens of countries over a four‑month span.
“Discover-Tech serves roughly 10 million ad impressions daily, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first‑party cookies,” Confiant added.
Investigators found that the ads routinely collected user session cookies, authenticated login tokens, and personal identifiers directly from publisher websites, exfiltrating the data even when EU privacy regulations strictly prohibited processing without consent.
Citizen Lab also revealed that an affiliated threat actor, dubbed Dark Cartographer, leveraged Discover‑Tech’s infrastructure to exploit vulnerabilities across mobile telecom providers, linking digital advertising identifiers to physical phone numbers to deanonymize mobile subscribers on a large scale.
– Focus on Palestine, sensitive targets
Geographic telemetry revealed sharp traffic spikes indicative of deliberate intelligence operations rather than ordinary commercial advertising campaigns.
Palestine emerged as the most heavily targeted territory, where Discover-Tech served nearly 2 % of all digital advertisements, peaking at roughly 10 % on April 7, with one in every 36 Android ads originating from the firm.
Surveillance traffic also landed directly on sensitive administrative and institutional networks, including the Armenian Prime Minister’s Office, international bodies, judicial agencies, universities, and defense organizations.
Investigators detected surgical handoffs to Candiru servers in nine countries, with Belgium accounting for 56 % of observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain, and others.
After the joint investigation was disclosed, Google, the European Advertising Association IAB Europe, Beeswax, Vungle, and Eskimi cut off Discover‑Tech’s access to their digital advertising platforms.