SECURITYWEEK reports that an Israeli advertising firm, Discover-Tech, has acted as a delivery channel for Candiru’s zero-click spyware through targeted ad campaigns. The firm’s Controlium platform purportedly enables de-anonymisation, device fingerprinting, and zero-click hacking when an advertisement is displayed on a victim’s device.
Investigations by Citizen Lab tie Discover-Tech to AdFection, a campaign that profiles users and infects devices on behalf of Candiru, with threat actors able to track millions of devices and de-anonymise advertising identifiers via connected ad networks.
Citizen Lab’s findings indicate that between 2024 and 2025 at least 45 devices at Al Jazeera were targeted, with the operation leveraging ads that connected to Discover-Tech infrastructure, submitted user advertising IDs, and executed JavaScript tailored to IPs and identifiers. An analysis of Discover-Tech’s servers revealed four billion ad bid records, showing the breadth of its ad deployments across around 200,000 unique websites and Android and iOS apps globally.
The research also notes associations with other surveillance actors, including Dark Cartographer, which is described as linking mobile advertising identifiers to phone numbers.
In response to the exposure, Google and IAB Europe removed Discover-Tech from vendor registries, and other platforms such as Beeswax and Eskimi imposed measures. Citizen Lab recommends defending by blocking targeted ads at the gateway until the industry can reliably block AdFection-style vectors. The piece stresses the distinction between evidenced infections in Al Jazeera and broader implications for real-world espionage through programmatic advertising channels.