Canadian researchers at the University of Toronto’s Citizen Lab say an Israeli online-advertising firm, Discover-Tech, used targeted ads as a vector for espionage. CBC News reported the findings: ads allegedly let devices be infected without a click, a technique the researchers call AdFection.

Citizen Lab’s report is, the authors say, the first public technical confirmation of mercenary spyware delivered through targeted ads. They say with high confidence that devices at Al Jazeera were targeted and infected with Candiru spyware (rebranded Integrity Labs), and that the malicious ads were bought by Discover-Tech.

The company presents itself as a legitimate advertising business. The researchers write that it functions as a bridge between mercenary spyware vendors and the ad ecosystem. Its Controlium platform, they say, lets partners de-anonymize users, fingerprint devices and infect them automatically when an ad is shown — a zero-click attack.

Al Jazeera provided evidence of at least 45 devices targeted in 2024–2025, BleepingComputer reported. Logs analysed by the researchers show a chain from Discover-Tech infrastructure to Candiru servers. The report is a technical investigation, not a court verdict.

Analysis of about four billion bidding records shows Discover-Tech ads appeared on almost 200,000 websites and apps in dozens of countries over four months, Citizen Lab said. BleepingComputer cited 3.77 billion bids and 442 million won auctions between March and June 2026. Those figures are not infection counts.

Discover-Tech appeared on “certified” vendor lists at Google and IAB Europe. After the disclosure, Google and IAB Europe cut its access in early October 2026. Beeswax, Vungle (Liftoff) and Eskimi took similar steps, the lab wrote. Other vendors did not reply in time.

The firm is led by CEO Dekel Boni. Eric Banoun sat on the board until 2025, Citizen Lab said. The report also links Discover-Tech to other surveillance-industry actors, including Bindecy and Intelos. Researchers asked regulators to investigate; they did not announce a criminal conviction.

RoAdevăr has not independently tested the infections. The conclusions are Citizen Lab’s; CBC reported them. In the sources consulted, Discover-Tech has not been convicted in a trial on this case.

Image: Andrijko Z., Munk School of Global Affairs, Toronto, 8 June 2016, CC BY-SA 4.0, Wikimedia Commons. The school that hosts Citizen Lab, not an attack.

Sources consulted: Israeli firm used ads to enable espionage, Canadian researchers say — CBC News; Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab.