THE investigation by Citizen Lab, as reported by Security Affairs, reveals that spyware operators used online advertising infrastructure to profile targets and deliver exploits without requiring users to click anything. The focus is Discover-Tech, linked to Candiru (an Israeli spyware vendor later known as Integrity Labs), with connections also noted to other surveillance firms such as Bindecy and Intelos.
By analysing almost four billion ad bid records from March to June 2026, Citizen Lab found Discover-Tech’s MyDSP platform bid on 3.77 billion impressions and appeared to win about 442 million (11.7%), with about 76.7% of bids for mobile app impressions and 23.3% for web browser impressions. Reuters, citing Citizen Lab and Confiant, indicated the broader activity touched more than 120,000 websites and 75,000 apps, potentially exposing hundreds of millions of users.
The researchers emphasised that exposure to an advertisement does not automatically mean infection, but the framework enables profiling and selective, more intrusive operations.
The article notes alarming targets across government, defence and other sensitive sectors, with 2024–2025 Al Jazeera zero‑click attacks strongly linked to Candiru’s spyware delivered via Discover-Tech ads, and activity observed on networks tied to the Pentagon, NATO, the United Nations, the European Commission and the ICC.
In response, Google terminated Discover-Tech’s ad‑exchange access, IAB Europe suspended its vendor status, Beeswax removed the company, and Liftoff’s Vungle paused access pending review; Eskimi also blocked accounts.
The piece argues that online advertising is an operational attack surface requiring security teams to extend controls beyond traditional threats, including blocking ads at gateways, limiting ad personalise, scrutinising ad‑load traffic and tightening controls on browser extensions and third‑party content on high‑risk devices.