Online advertising infrastructure was used to profile millions of people and silently deliver mercenary spyware to selected targets, according to coordinated investigations published Thursday by the Citizen Lab and ad-security firm Confiant.
The Citizen Lab says Israel-based Discover-Tech connected mainstream ad exchanges with surveillance companies, including Candiru. A targeted ad could run code as soon as it appeared in a website or app; the victim did not need to click it. Researchers call the technique "AdFection."
The finding is not that every advertisement infected every viewer. Most impressions appear to have fed a broad profiling system, while a much smaller set of carefully selected devices received spyware-related code. That distinction matters, but it does not make the underlying architecture reassuring: the same machinery built to identify the right customer at the right moment can identify the right surveillance target instead.
Mass reach, surgical delivery
Citizen Lab analyzed nearly four billion exposed ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026. The records included impressions from government, defense, media and international-organization networks. An impression on a sensitive network does not prove that a person was targeted or infected, the researchers caution.
The team did confirm one operation in detail. It linked Discover-Tech advertising infrastructure to Candiru spyware attacks against at least 45 Windows devices at Al Jazeera during 2024 and 2025. The researchers say network logs supplied by the broadcaster let them trace the delivery chain with high confidence.
Confiant independently found device fingerprinting, covert command-and-control channels and code-execution capability in ads it began investigating in April. It estimates that Discover-Tech served roughly 10 million ad impressions a day. Across more than 1,000 publisher domains, Confiant also observed scripts collecting first-party cookies; in some cases those cookies contained authenticated session identifiers or personal data encoded in tokens.
The gatekeepers acted after the investigation
Discover-Tech had appeared on Google and IAB Europe vendor lists since 2020, status that helped it participate in the legitimate ad ecosystem. Citizen Lab says Google collaborated with the investigation and terminated the company’s access to its ad exchanges in early October. IAB Europe removed Discover-Tech from its global vendor list, Comcast-owned Beeswax removed it from its buying platform, and other intermediaries paused or blocked access.
Reuters reported that Discover-Tech and Candiru’s owners did not respond to requests for comment. The research therefore establishes technical links and observed behavior, not a court finding. It also leaves open how many people were deliberately selected for infection, how many devices were successfully compromised, and whether related operators remain active elsewhere.
TINA’s view: the security boundary was misplaced
TINA’s view: The immediate disruption is meaningful, but the larger problem is structural. Ad auctions expose identifiers and device details to many intermediaries, while ad creatives can execute code inside pages and apps. A vendor that passes an industry review can still become a bridge between mass data collection and precise exploitation.
Citizen Lab recommends blocking ads and tracking on managed devices and at organizational gateways, limiting advertising identifiers, and treating ad delivery as an attack surface rather than harmless page decoration. Those steps cannot repair the advertising market, but they can reduce what a hostile bidder learns and what code reaches a device.
The next test is whether platforms publish stronger vetting, monitoring and incident-disclosure rules for ad vendors. Cutting off one company closes one route. The research shows why the route existed at internet scale in the first place.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
