The key facts
- According to Citizen Lab, Discover-Tech served as a 'bridge' between advertising vendors and the spyware market
- The Candiru attack affected at least 45 Windows computers at Al Jazeera in 2024–2025
- The platform's ads were shown on devices of militaries, government agencies and critical infrastructure; the customers of the attacks have not been identified
Ad networks as a delivery channel for spyware
The Citizen Lab at the University of Toronto published a report asserting that the Israeli company Discover-Tech allows spyware makers to use its advertising platform to target specific individuals and devices virtually anywhere in the world. According to the researchers, Discover-Tech positions itself as a legitimate advertising firm but in fact acts as a 'bridge between advertising vendors and the mercenary spyware ecosystem.'
The Al Jazeera attack and the companies involved
According to the report, at least two developers of zero-click spyware — Candiru and Bindecy — used the Discover-Tech platform to target victims. Such software can infect devices without the user opening a message or clicking a link. One attack affected at least 45 Windows computers at the media organization Al Jazeera: the devices were hacked in 2024 and 2025 with Candiru spyware after malicious ads were displayed. Citizen Lab notes that it is unclear which governments were behind the attacks, but this is the first confirmed delivery of government zero-click spyware through online advertising.
Technical evidence and data leaks
The Discover-Tech platform, called Controlium by the company, left part of its source code exposed on login pages, which allowed researchers to recreate the web control panel without authorization. According to them, the panel 'appears to be purpose-built for delivering malicious content to individual targeted users alongside ads.' In addition, the company's website had a publicly accessible section from which login records of panel users could be downloaded without a password — including data of at least two Candiru employees and some Bindecy employees. The site also exposed billions of ad bid records showing that Discover-Tech ads were displayed across tens of thousands of mobile apps and websites from March to June 2026.
Scale of impact and reaction
According to the bid records, ads were shown on devices of militaries, governments, critical infrastructure and national cyber agencies; it is unclear whether any of the impressions led to compromise. Researchers at the ad quality platform Confiant, who collaborated with Citizen Lab, found evidence that potentially malicious ads were also shown on devices on the networks of the IAEA and the International Criminal Court. Citizen Lab senior researcher Bill Marczak called Discover-Tech 'surely just the tip of the iceberg' and urged people who may be targets to disable ad tracking or block ads. Al Jazeera and Discover-Tech did not respond to requests for comment; Candiru (the company Integrity Labs) could not be reached.
