Spyware Distribution via Ads: New Findings from Researchers
A recent investigation reveals how an Israeli ad tech company is linked to spyware attacks via online advertising.
In a groundbreaking investigation, researchers from Citizen Lab and Confiant have uncovered troubling activities by an Israeli advertising technology firm that facilitates the delivery of spyware through online advertisements. This startling revelation highlights a new trend in cyberattacks, particularly involving zero-click vulnerabilities that can infect devices without requiring user interaction.
Discover-Tech's Role in Cyber Intrusions
The firm at the center of this investigation, known as Discover-Tech, operates much like a standard online ad agency on the surface. However, findings suggest that the company serves as a critical link for various hacking groups, enabling them to spread malicious advertisements across the internet.
Utilizing its advanced platform, dubbed “Controlium,” Discover-Tech collaborates with spyware developers to create highly targeted advertisements. This platform is engineered to facilitate the profiling and de-anonymization of millions of users. Notably, it allows cybercriminals to infect or monitor specific individuals by simply using their IP address, mobile ad ID, or browser identifiers.
The Collaboration with Candiru
One of the most noteworthy partnerships highlighted in the investigation is between Discover-Tech and the infamous Israeli spyware company, Candiru. This particular firm has been sanctioned by the US government for its questionable practices. Throughout the years 2024 and 2025, advertisements linked to Discover-Tech reportedly delivered spyware associated with Candiru directly to Al Jazeera, a prominent news organization based in Qatar.
Alarmingly, researchers indicate that at least 45 devices connected to Al Jazeera were targeted during this timeframe. This incident marks a significant breach of security, raising serious concerns about the protection of journalistic entities and their staff.
Industry Response and Recommendations
In light of these findings, Citizen Lab and Confiant urge the advertising industry to enhance their security measures to prevent similar breaches in the future. Following the investigation’s release, major platforms such as Google and Beeswax, owned by Comcast, have opted to ban Discover-Tech from their networks. Additionally, IAB Europe has suspended the company from its roster of approved vendors.
To mitigate the risks associated with such vulnerabilities, experts recommend that users—especially those in high-risk categories—implement ad blockers, disable ad tracking features, and periodically reset their mobile ad identifiers to enhance their privacy and security online.
Cybersecurity researchers emphasize the urgent need for heightened protection against emerging threats posed by advertisement-driven spyware.
