Israeli Ad Firm Doubled as Candiru’s Zero

A sophisticated spyware infection campaign, dubbed AdFection, utilized advertising networks to compromise devices globally, notably affecting the news organization Al Jazeera. The operation leveraged advertisements purchased by Israeli company Discover-Tech, using its Controlium platform to execute zero-click attacks. This ecosystem relies on Real-Time Bidding (RTB) auctions where ad exchanges collect extensive user and device data for tracking purposes. While ads typically serve for monitoring impressions or clicks, the mechanism enabled threat actors to de-anonymize users, fingerprint devices, and deploy malicious code, including Candiru spyware in targeted incidents against Al Jazeera between 2024 and 2025.
Discover-Tech appears to function as a conduit linking ad vendors with mercenary spyware providers, using its advertising placements as the delivery mechanism for espionage. Citizen Lab confirmed that Discover-Tech's infrastructure was used both to profile users on behalf of Candiru and in broader surveillance activities involving other threat actors, such as Dark Cartographer, which exploits mobile carrier vulnerabilities to link identifiers to phone numbers. In response to these threats, several industry players, including Google and IAB Europe, have begun removing the company from their vendor registries.

Candiru spyware infected devices at Al Jazeera via zero-click attacks routed through targeted advertisements.
The operation is termed AdFection, utilizing ads bought by Israeli company Discover-Tech.
Discover-Tech's Controlium platform facilitates de-anonymization and device fingerprinting.
Ad exchanges host billions of daily Real-Time Bidding (RTB) auctions that collect user data.
Ads can contain code designed for tracking impressions, clicks, or malicious infection.
Between 2024 and 2025, at least 45 devices within Al Jazeera were targeted by AdFection attacks.
Citizen Lab identified a Discover-Tech server exposing four billion ad bid records.
Discover-Tech's ads appeared on nearly 200,000 unique websites and mobile applications globally.
Google and IAB Europe removed Discover-Tech from their registries in early October.
Dark Cartographer is reported to be building databases linking advertising identifiers to phone numbers.

<STEELMAN>
The strongest narrative supported by the evidence presented is that modern digital advertising ecosystems possess a profound, latent vulnerability: they function as unintentional vectors for sophisticated espionage. Citizen Lab's detailed analysis demonstrates how commercial processes—specifically RTB auctions and ad exchange data aggregation—can be hijacked by an entity like Discover-Tech to bridge legitimate marketing infrastructure with advanced cyber weaponry (Candiru). The structure posits that the motive is surveillance capitalism crossing into state/mercenary espionage, using the necessity of personalized advertising as a Trojan horse.
</STEELMAN>
<PATTERN SCAN>
The deployment relies on leveraging necessary, functional components (ad identifiers, browser execution capabilities) for an illicit end. This aligns with ARC-0118 Functional Exploitation, where a baseline function required by legitimate activity becomes the pivot point for malicious action. The recommendation for defenders to "block targeted ads at the gateway" reflects a defensive response attempting to neutralize this systematic vector without requiring changes to the core mechanisms of ad deployment itself.
Patterns detected: ARC-0118 Functional Exploitation
</PATTERN SCAN>
The primary paradigm driving this narrative is the commodification and weaponization of behavioral data. The unstated assumption underpinning the entire system—advertising, in particular—is that consent given for "targeted advertising" implies only tracking for sales purposes, not exposure to nation-state or mercenary spyware capable of zero-click exploitation. This shifts the risk landscape from targeted political speech to existential digital compromise hidden within the consumer experience.
The cost is asymmetric: massive surveillance profit and state intelligence gathering benefit corporate intermediaries and hostile actors, while the cost—device compromise and infiltration—is borne by individual users globally, regardless of their perceived digital sophistication. Second-order consequences include the erosion of trust in all seemingly innocuous online interactions; if a simple banner ad can install espionage software, digital public life becomes inherently suspect.
What fundamental shift in privacy engineering would be required for advertising to remain safe? Should regulatory focus move from data collection limits to execution environment limitations at the network gateway? If defensive blocking is the only immediate remedy, what pressures does that place on the global liquidity and efficacy of ad exchanges themselves?
If a state actor were attempting to push this narrative through influence operations, they might initially frame Discover-Tech as an outlier criminal element (a manufactured crisis) while simultaneously downplaying the systemic nature of RTB’s data aggregation protocols. The actual reporting aligns closely with documenting a verifiable failure mode within existing infrastructure rather than pushing a single polarized solution.