Google and IAB Europe listed Discover-Tech as certified until Citizen Lab showed them its spyware-linked ads

Confirmed harm is narrow and measured exposure is wide

The sources separate a confirmed compromise from a measured exposure, and the two should not be read as one number. The compromise is 45 Windows devices at Al Jazeera between 2024 and 2025, which Citizen Lab could confirm because Al Jazeera shared its network logs ^[2]. A Financial Times report carried by financialpost.com described the targets as journalists and staff ^[3]. Citizen Lab calls this the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising ^[1].

The exposure figures are on a different scale. Between March and June, Discover-Tech bid to show ads 3.77 billion times and won about 442 million auctions, across 75,373 mobile apps and 120,768 websites, according to iTnews's account of the Citizen Lab report ^[4]. That is 196,141 apps and sites in total ^[38], close to Citizen Lab's own summary of almost 200,000 ^[6]. Wins were 11.7 percent of bids ^[39]. The bid total varies by account: financialpost.com gives 3.7 billion ^[5], and Citizen Lab's summary refers to four billion bidding records ^[6]. We use the iTnews figure because it is the most precise of the three. Confiant co-founder Jerome Dangu said the company was serving at least 10 million ads a day ^[7]. "Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said ^[8].

The sources also support caution. Confiant noted that the ads it linked to Candiru were a tiny fraction of Discover-Tech's overall advertising volume ^[9]. Citizen Lab said an ad appearing on a network does not, on its own, show that anyone there was targeted or infected ^[10]. ANSTO, which Citizen Lab named among the Australian networks where impressions appeared ^[11], said through a spokesperson: "We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports" ^[12]. iTnews adds that Australia was not among the nine countries where devices were seen being handed to Candiru's systems ^[14].

Infection is documented at one organisation ^[2], and reach across many others ^[36]. Every reached network faces profiling in the meantime. "At minimum, we assess that these ad impressions would have resulted in profiling by Discover-Tech," the researchers said ^[18]. According to the Citizen Lab report as described by financialpost.com, the software profiles and de-anonymizes a user before deciding whether to target them with spyware ^[19].

The accounts of Candiru's share look different at first. Citizen Lab said the ads covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance ^[37]. Confiant calls the Candiru-linked ads a tiny fraction of a volume it puts at 10 million ads a day ^[9][7]. Without a Candiru-linked ad count, the two accounts cannot be tested against each other.

How a render becomes a selection

When a site or app shows an ad, bidders are sent details about the device, including its internet address and its advertising tracking ID ^[17]. The address can reveal a rough location and which organisation's network the device connects to ^[17]. Discover-Tech's ads carried a program that contacted the company's servers whenever the ad loaded ^[15]. Its Controlium control panel let customers single out targets using tracking IDs or internet addresses, and limit campaigns to particular countries ^[16]. For most devices nothing further happened. For selected targets, the servers sent back code that could lead to infection with no click ^[15].

The selector is an identifier, and the bid request supplies two. In our view, an operator holding a person's advertising ID can pick that person's device, and an operator who knows an organisation's network address can pick whoever sits on it. The first route follows a device from network to network. The second covers a whole building. That is why executive exposure cannot be read off the reach figures: the confirmed victims were journalists and staff ^[3], and the sources do not say whose identifiers sat on Discover-Tech's target lists.

Identity linking widens the first route. Ctech reported that in some cases the ads only needed to load on a website for the surveillance to take place, and that the company would sometimes try to extract phone numbers from smartphone users ^[20]. A separate actor that Citizen Lab calls DARK CARTOGRAPHER uses Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers and link advertising IDs with phone numbers, which Citizen Lab describes as mass-deanonymizing internet users ^[21].

How the reach is worded

The accounts of who was reached use different verbs. Citizen Lab said it found evidence that ads were shown to people using networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments, and with semiconductor companies including Nvidia, SanDisk, Broadcom and Micron ^[36]. The Financial Times report carried by financialpost.com said hundreds of thousands of ads were targeted at officials and employees at organizations including NATO, the European Commission, Nvidia and Arm ^[35].

"Shown to people using networks associated with" describes where an ad rendered. "Targeted at" implies a choice by the buyer. Citizen Lab's own caution ^[10] supports the first reading as the one the evidence has established, and the Controlium selector ^[16] shows why the second is possible.

Where the vetting sat

Discover-Tech appeared on lists of certified and approved vendors kept by Google and IAB Europe, and served ads through Google, Yandex and Beeswax ^[22]. Citizen Lab says it also used the GDPR consent frameworks to target users in the European Union ^[22]. The company presents itself as a legitimate advertising firm; Citizen Lab found it operates as a facilitator for multiple mercenary spyware partners ^[23]. It was registered in Israel in March 2020 by its chief executive, Dekel Boni, and neither the company nor Boni responded to requests for comment ^[31].

financialpost.com reported that Google and IAB Europe listed it as certified until they were shown the researchers' findings ^[24]. "Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies," Google said in a statement to the FT ^[25]. IAB said it had suspended the company from its global vendor list pending further investigation ^[26]. Citizen Lab says it disclosed its findings to ad vendors and industry organizations, and that Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi acted to disconnect Discover-Tech. Other vendors did not respond within the timeline it gave ^[27].

The sources tie these actions to the researchers' disclosure. The Citizen Lab report, which RuntimeWire says was published on October 15 ^[30], already lists the vendors that had acted ^[27], so the actions came no later than publication. The detection the sources describe came from the researchers' side. Confiant's scanner flagged an ad creative on April 12, 2026 ^[29], after the Al Jazeera infections that Citizen Lab dates to 2024 and 2025 ^[40]. Citizen Lab's verdict is that structural flaws in the online advertising system "failed to detect or prevent the abuse documented in this report" ^[28]. We do not know yet whether the vendors that did not respond have since cut Discover-Tech off.

What an organisation can control

Citizen Lab recommends that governments make ad blocking mandatory and switch off advertising tracking IDs, iTnews reported ^[33]. Citizen Lab also makes recommendations to lawmakers, defenders and the advertising industry ^[34]. ANSTO did not disclose whether it blocks ads on staff devices or across its network, iTnews reported ^[13].

Each of the two measures acts on one input to the selection. Blocking the ad removes the render that carries the code. Switching off the tracking ID removes one of the two identifiers the bid request supplies, and leaves the network address in it ^[17]. In our view the pair works as a fleet-wide control. The alternative is a protected list of named individuals, and the Al Jazeera pattern argues against it: 45 devices among journalists and staff ^[2][3] is a population wider than any short list of leaders. The trade-off is a blanket control that touches every user against a narrow one that bets on knowing who an attacker wants. The evidence favours the blanket control, whatever it costs in friction for ordinary users.

An organisation can treat ad rendering as an exposure it controls itself, or it can leave the control with the vendor lists. The vendor-side processes are still open. IAB Europe suspended Discover-Tech pending further investigation ^[26]. Citizen Lab has asked regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws ^[34]. "Discover-Tech is surely just the tip of the iceberg," said Bill Marczak, a senior researcher at Citizen Lab ^[32]. Citizen Lab says a separate report on DARK CARTOGRAPHER is forthcoming and that it is working with vendors to mitigate that attack ^[21].