Zero-click Candiru attacks on Al Jazeera devices ran through an ad vendor Google had approved
Citizen Lab said Discover-Tech's ads delivered zero-click Candiru attacks to at least 45 Al Jazeera devices. Google and IAB Europe have delisted the vendor, but Citizen Lab cannot yet attribute the attacks to any party.
The Watch · Security desk
Two bars: researchers found Discover-Tech ads displayed on over 120,000 websites and over 70,000 mobile apps between March and June of this year.
Places showing Discover-Tech ads, March to June In count
| Item | Value | Claim |
|---|---|---|
| Websites showing its ads, over | 120,000 count | 8 |
| Mobile apps showing its ads, over | 70,000 count | 8 |
What happened
- Citizen Lab concluded that Discover-Tech presents itself as a legitimate advertising firm but works as a facilitator for several mercenary spyware partners, Candiru among them.
- Partner investigators at ad security firm Confiant found the vendor's ads on sensitive networks, among them the U.S. Department of Defense, NATO, the IAEA and cybersecurity agencies worldwide.
- Between March and June, the researchers found its ads displayed on over 120,000 websites and over 70,000 mobile apps.
- Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024.
Why it matters
- constraint Google's and IAB Europe's vendor lists carried Discover-Tech until this research, so a listing is not evidence that a vendor is safe to serve ads to a sensitive network.
- decision Teams running sensitive networks have to decide whether ad traffic is allowed at all, since vendor vetting upstream did not stop these ads from arriving.
- precedent Citizen Lab is asking regulators to investigate and sanction an ad-tech intermediary. In our view, the response will set the standard for the next ad vendor found serving spyware partners.
The delivery step takes one sentence in Citizen Lab's report: "Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered." [11] Once Candiru is on a device, it can take the device over remotely, steal data and reach the microphone and camera. [9]
Read the sensitive-network claim narrowly. Partner investigators at Confiant found Discover-Tech ads displayed on those networks. [4] Citizen Lab's own finding of infection is at Al Jazeera, where the researchers said the campaign led to the infection of devices. [19] A displayed ad gives Controlium the chance to fingerprint a device. [11] CyberScoop did not report a confirmed compromise at the Defense Department, NATO or the IAEA.
The delistings apply to Discover-Tech. [7] Citizen Lab ties the company to a second mercenary hacking firm, Bindecy, and to an ad intelligence firm, Intelos. [10] It also describes a separate actor, DARK CARTOGRAPHER, that uses Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers. [14] That actor's activity involves other vendors, including an unnamed U.S. intelligence contractor, and dates to 2019. [13] The start date is a year before Discover-Tech was registered. [21]
Earlier reports had touched on spyware that infects through online ads. This is the first technical demonstration of infections and distribution through targeted advertising. [15] On those dates, in our view, this is a sustained operation that has run since 2019.
The researchers' stated view of the likely goal is large-scale tracking and surveillance, enabled by accident by major industry players like Google. [16] Jerome Dangu, chief technology officer and co-founder of Confiant, said: "The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance." [17]
Wolfie Cristl, senior researcher at The Citizen Lab, said it was "disastrous" that ad vendors did not detect the operation for years. [18]
What to watch
- Whether any regulator opens an investigation or imposes sanctions on Discover-Tech, as Citizen Lab has asked.
- Whether the unnamed U.S. intelligence contractor tied to DARK CARTOGRAPHER is identified, or Citizen Lab can attribute the Al Jazeera attacks to a party.
- Whether Bindecy, Intelos or other Discover-Tech partners resurface through different ad vendors after the Google and IAB Europe delistings.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption70
- Hype gap+15
- Incentives45
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Citizen Lab at the University of Toronto said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it calls AdFection.
- [2]
Citizen Lab concluded that Israeli company Discover-Tech presents itself as a legitimate advertising firm but in actuality operates as a facilitator for multiple mercenary spyware partners, including Candiru.
- [3]
Citizen Lab said at least 45 devices at Al Jazeera were targeted in zero-click attacks that it linked with high confidence to Candiru spyware delivered by Discover-Tech's ads.
- [4]
Discover-Tech's ads have appeared on many sensitive networks around the world, including at the U.S. Department of Defense, NATO, the International Atomic Energy Agency and world cybersecurity agencies, according to partner investigators at ad security firm Confiant.
- [5]
Citizen Lab cannot currently attribute the AdFection attacks to any specific party.
- [6]
Discover-Tech has appeared on lists of 'certified' and 'approved' vendors maintained by Google and IAB Europe, an advertising industry association.
- [7]
In response to the research, Google removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, and IAB Europe removed Discover-Tech from its global vendor list.
- [8]
Between March and June of this year, researchers found Discover-Tech ads displayed in over 120,000 websites and over 70,000 mobile apps.
- [9]
Candiru spyware has shown the ability to take over a device remotely, steal data from it, and access its microphone and camera.
- [10]
Researchers found Discover-Tech has connections to another mercenary hacking firm, Bindecy, and a mercenary ad intelligence firm, Intelos.
- [11]
The Citizen Lab report states: 'Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.'
- [12]
Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024.
- [13]
The activities of a threat actor the researchers dubbed DARK CARTOGRAPHER, which involve Discover-Tech and other vendors including an unnamed U.S. intelligence contractor, date back to 2019.
- [14]
Citizen Lab describes DARK CARTOGRAPHER as a separate threat actor using Discover-Tech's infrastructure to exploit vulnerabilities across numerous mobile carriers.
- [15]
Earlier reports have touched on the existence of mercenary spyware that can infect users through online ads, but this research is the first technical demonstration of infections and distribution through targeted advertising.
- [16]
The likely goal, according to the researchers, is large-scale tracking and surveillance, enabled by accident by major industry players like Google.
- [17]
Jerome Dangu, chief technology officer and co-founder of Confiant, said: 'The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance.'
- [18]
Wolfie Cristl, senior researcher at The Citizen Lab, said it was 'disastrous' that ad vendors didn't detect the operation for years.
- [19]
The campaign led to the infection of devices at media outlet Al Jazeera, the researchers said.
- [20]
The Citizen Lab said regulators need to investigate Discover-Tech and levy sanctions.
- [21]
DARK CARTOGRAPHER's activity begins one year before Discover-Tech was registered.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- cyberscoop.comAdFection: How mercenary spyware invades victims’ devices through targeted advertising
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Mercenary SpywareFollow
- Zero-click exploitsFollow
- MalvertisingFollow