Citizen Lab’s October 15, 2026 report provides the first public technical confirmation that targeted online advertisements can deliver zero-click mercenary spyware. An Israeli company called Discover-Tech, which presented itself as a legitimate advertising firm, operated a platform named Controlium. This platform allowed spyware partners to profile people using advertising identifiers and IP addresses, then serve them ordinary-looking ads that could install malware the moment the ad loaded. No click or other user action was required.
In 2024 and 2025, at least 45 devices belonging to the news network Al Jazeera were targeted this way and infected with spyware from Candiru, which has rebranded as Integrity Labs. Network logs from Al Jazeera showed the sequence: an ad from Discover-Tech infrastructure, a connection to Candiru validation servers within seconds, then exploit and command-and-control traffic. A recovered Windows sample matched known Candiru characteristics. The same infrastructure also directed millions of other devices to Candiru-linked servers for tracking and reconnaissance.
Discover-Tech’s ads appeared on nearly 200,000 unique websites and mobile apps. Analysis of roughly four billion bidding records from March to June 2026 showed bids on about 3.77 billion impressions, with roughly 442 million won. Ads reached apps such as Duolingo, Viber, Yahoo Mail, and period trackers, as well as websites including major news outlets. The system could select targets by mobile advertising ID, browser identifiers, or IP address. Discover-Tech had been listed as a certified or approved vendor by Google and IAB Europe since 2020.
After researchers disclosed the findings, Google terminated Discover-Tech’s access to its advertising platforms and deployed Safe Browsing protections for associated domains. Beeswax, IAB Europe, and other platforms also restricted or removed the company. Citizen Lab found no evidence of legitimate advertising activity by Discover-Tech and documented links to additional spyware and intelligence vendors including Bindecy and Intelos. The report states that simply rendering a targeted ad was sufficient for infection on selected devices, and that structural weaknesses in the advertising ecosystem enabled the activity at scale.
Sources
Exposing AdFection Executive Summary
https://citizenlab.ca/research/exposing-adfection-executive-summary/
Citizen Lab executive summary of the October 15, 2026 report confirming the first technical demonstration of zero-click mercenary spyware delivered via targeted ads by Discover-Tech’s Controlium platform, including Al Jazeera infections.
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
Full Citizen Lab Report 195 detailing Controlium, bidding record analysis, Candiru sample indicators, scale across websites and apps, and platform responses including Google’s termination of access.
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
Wired coverage of the Citizen Lab findings, the targeting of 45 Al Jazeera devices, Google’s actions, and the mechanism by which ads could install spyware without user interaction.
Israeli ad-tech firm helped place spyware on Al Jazeera devices
https://www.aljazeera.com/news/2026/10/15/israeli-ad-tech-firm-helped-spy-on-al-jazeera-devices
Al Jazeera’s report on the Citizen Lab investigation, confirmation of spyware on staff devices via Discover-Tech ads, and the network’s statement on the targeting.
Report: Israeli ad-tech firm enables spyware targeting of at least 45 Al Jazeera devices
Committee to Protect Journalists summary of the Citizen Lab report on Discover-Tech facilitation of Candiru spyware against Al Jazeera and broader media and institutional networks.
https://v.redd.it/5yu8iyixuovh1
Source: r/ObscurePatentDangers · by /u/CollapsingTheWave