Israeli digital advertising firm Discover-Tech weaponised a vast commercial ad network to harvest personal data and deliver mercenary spyware to targeted devices worldwide, Canadian cyber watchdog Citizen Lab and New York-based ad security firm Confiant reported.
"The core finding is the weaponisation of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterised by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting," Confiant said in its investigative findings on Thursday.
The coordinated operation enabled US-blacklisted Israeli spyware company Candiru, rebranded as Integrity Labs, and surveillance vendor Intelos to exploit commercial ad inventory across major global platforms, including Google, Beeswax and Russia's Yandex, to track targets and compromise consumer devices.
Citizen Lab described the campaign as the first public technical confirmation of zero-click mercenary spyware delivered through online advertising, a method researchers termed "AdFection."
Devices belonging to staff at international news network Al Jazeera were among those infected through the weaponised ad placements, which operated silently without visible pop-ups or suspicious links.
Surveillance
Discover-Tech operated a specialised system called Controlium that converted routine commercial advertising auctions into an expansive surveillance apparatus.
After analysing 4 billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS in dozens of countries during four months.
"Discover-Tech serves roughly 10 million ad impressions a day, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first-party cookies," said Confiant.
Investigators found that the ads routinely collected user session cookies, authenticated login tokens, and personal identifiers directly from publisher websites, exfiltrating the data even when European Union privacy regulations strictly barred processing without consent.
Citizen Lab also revealed that an affiliated threat actor, dubbed Dark Cartographer, utilised Discover-Tech's infrastructure to exploit vulnerabilities across mobile telecom providers, matching digital advertising identities to physical phone numbers to deanonymize mobile subscribers en masse.
Focus on Palestine
Geographic telemetry revealed sharp traffic spikes pointing to deliberate intelligence operations rather than ordinary commercial advertising campaigns.
Palestine emerged as the most heavily targeted territory, where Discover-Tech served nearly 2 percent of all digital advertisements in the territory, peaking at roughly 10 percent on April 7, with one in every 36 Android ads originating from the firm.
Surveillance traffic also landed directly on sensitive administrative and institutional networks, including the Armenian Prime Minister’s Office, international bodies, judicial agencies, universities and defence organisations.
Investigators detected surgical handoffs to Candiru servers in nine countries, with Belgium accounting for 56 percent of observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain, and others.
After the joint investigation was disclosed, Google, the European advertising association IAB Europe, Beeswax, Vungle, and Eskimi severed Discover-Tech's access to their digital advertising systems.
