Online advertising technology is facing fresh security concerns after researchers linked an Israeli ad-tech company to a system allegedly capable of delivering spyware to mobile devices simply by displaying an advertisement, without requiring victims to click.
The company, Discover-Tech, reportedly uses its Controlium platform to help surveillance operators identify potential targets, collect device information, and facilitate attacks. Investigators from the University of Toronto's Citizen Lab and cybersecurity firm Confiant linked the operation to spyware vendor Candiru, also known as Integrity Labs.
The findings include links to spyware infections affecting at least 45 Al Jazeera journalists between 2024 and 2025, raising concerns about the misuse of advertising networks to conduct covert surveillance.
How Advertisements Become an Attack Channel
Citizen Lab has described the technique as “AdFection,” referring to the use of targeted advertising infrastructure to support spyware delivery.
According to researchers, Discover-Tech's advertisements can contain code that collects information when an ad loads, including a device's advertising identifier and internet address. The information is sent to a server, which can determine whether the device matches a surveillance target. If it does, malicious code may be returned to the device.
Confiant said the technology incorporates device fingerprinting and a concealed command-and-control channel, allowing operators to assess potential targets before attempting to deliver a more damaging payload.
Researchers cautioned that they had not captured a complete exploit chain operating in the wild, but said the surrounding infrastructure demonstrated sophisticated targeting and delivery capabilities.
The spyware associated with the operation is reportedly capable of collecting device and network metadata, monitoring keyboard activity and clicks, recording calls, activating microphones and accessing emails.
Millions of Users Potentially Exposed
Citizen Lab's investigation examined nearly four billion advertising records associated with Discover-Tech. Between March and June, the company's ads appeared across more than 70,000 mobile applications and 120,000 websites, according to the report.
The researchers also identified advertising impressions across networks connected to government agencies, international institutions, major media organizations and technology companies.
Reportedly affected environments included networks associated with the United Nations, NATO, European Union entities and government agencies in countries such as Denmark, Norway, Sweden and Australia.
Confiant separately identified Discover-Tech-related advertisements in networks associated with the US Department of Defense, government offices in the Netherlands, Spain, Armenia and Estonia, as well as the International Atomic Energy Agency and the International Criminal Court.
The presence of advertisements in these networks does not, by itself, establish that every organization or individual exposed was infected. However, the findings illustrate how broadly the advertising infrastructure was distributed.
Researchers also linked Discover-Tech's advertising activity to other surveillance operations, including a group called Dark Cartographer, which reportedly conducts large-scale efforts to identify and de-anonymize internet users.
Advertising Industry Faces Scrutiny
Discover-Tech reportedly distributed advertisements through several advertising technology providers, including Google, IAB Europe, Beeswax and Xandr. Google and IAB Europe had listed the company as certified or approved, according to the investigation.
Following the findings, Google and IAB Europe removed Discover-Tech from their respective registries, while Beeswax removed the company from its advertising platform. Google also assisted with the investigation, according to the report.
The case highlights concerns about the safeguards used to vet advertising partners and the possibility that legitimate ad-distribution systems can be repurposed for surveillance.
Calls for Stronger Oversight
Commercial spyware has long been criticized for its use against journalists, human rights activists, political opponents, and other individuals. Researchers say the latest findings demonstrate how advertising technology could provide another route for operators to identify and compromise targets.
Citizen Lab warned that the advertising intelligence and commercial spyware industries remain insufficiently regulated, potentially allowing governments and other clients to gain invasive surveillance capabilities.
“This case should serve as an alarm to the advertising industry that business as usual is no longer acceptable,” the researchers wrote, calling for stronger action against the distribution of mercenary spyware through targeted advertising.
The findings place renewed pressure on advertising platforms to scrutinize their partners, detect malicious campaigns, and prevent targeted ads from becoming a covert delivery mechanism for digital surveillance.
Source: Security Boulevard