Reuters reports that two research groups accused Discover-Tech of tracking targets through online ads.
Two research groups said Discover-Tech used a sprawling network of online ads to spy on internet users, track targets and help hack their devices, Reuters reports.
218.2K
2 Sources, first seen ago
Two cybersecurity research groups say Israeli advertising company Discover-Tech used the machinery of online advertising to track users at massive scale and, in a smaller number of cases, help deliver spyware without requiring a click.
Citizen Lab said the technique, which it calls “AdFection,” is the first publicly documented case of zero-click mercenary spyware delivered through targeted ads. Its researchers linked Discover-Tech’s infrastructure to attacks using spyware from Candiru, an Israeli company blacklisted by the U.S. government.
Online ads are placed through automated auctions that share identifiers such as IP addresses, cookies and mobile advertising IDs. Citizen Lab said Discover-Tech’s Controlium platform let surveillance customers use those identifiers to select specific devices for profiling or infection.
When one of the ads rendered, it could contact Discover-Tech’s servers and run additional code. Most impressions were used for tracking rather than infection. But for selected targets, researchers said the same pipeline could hand off to malicious code without the user clicking anything.
Citizen Lab said it linked the system with high confidence to attacks on at least 45 devices at Al Jazeera during 2024 and 2025. The group based that finding on network logs supplied by the broadcaster and a spyware sample recovered from one compromised device.
The spyware handoffs were only a small part of the network’s activity. Citizen Lab said four billion advertising-bid records showed Discover-Tech ads appearing across almost 200,000 websites and mobile apps during a four-month period.
Confiant estimated that Discover-Tech served roughly 10 million impressions a day. It said those impressions fed an identity graph built from device fingerprints, IP addresses, advertising IDs and, in some cases, publishers’ first-party cookies.
Confiant also found the ads on hundreds of government, defense, health and international-organization networks. The researchers cautioned that an ad reaching an organization’s network does not prove a particular person was deliberately targeted.
According to Reuters, Google removed Discover-Tech from its advertising platforms for policy violations, IAB Europe suspended it from its approved-vendor list, and Comcast’s Beeswax removed it from its platform. Discover-Tech did not respond to Reuters, and the outlet said it could not reach Candiru’s owners.
—
Not ranked yet
—
Not ranked yet
