Inside the Spyware Pipeline Hidden in Online Advertising
Photo: Shutterstock 2026-10-22
A new Citizen Lab report says an Israeli ad firm acted as a bridge between the spyware industry and the world’s biggest ad exchanges. Its reach extended into Central and Eastern Europe. Targeted advertisements served as infection points for a zero-click mercenary spyware. The researchers call the technique “AdFection.”
Seeing an ad on your device can be enough to get a device infected. The central claim of a new Citizen Lab (University of Toronto) report is that it provides the first public technical proof that zero-click mercenary spyware has been delivered through targeted online advertising. The documented victim is Al Jazeera. In 2024 and 2025, at least 45 devices at the network were targeted, and Citizen Lab links the attacks with high confidence to Candiru, a spyware vendor now operating as Integrity Labs.
The Company in the Middle
The delivery vehicle was Discover-Tech, an Israeli firm that presents itself as an ordinary advertising company. Citizen Lab argues that its main purpose is to be a bridge between ad exchanges and the spyware industry. Its Controlium platform lets customers select an individual by advertising ID, cookie or IP address and send them a “controlled ad.” The Citizen Lab found that Discover-Tech published the full frontend source code on their app’s login page which allowed them to reconstruct the point of view of a user when they use the interface.
The design is built to evade scrutiny. Discover-Tech’s ads ping back its own server, which decides whether the viewer is a target. Most viewers receive an empty response, so the exchanges and ad networks that carry the ads never handle the malicious code. The company is led by Dekel Boni, who has a background in digital advertising. Since the company’s founding in 2020 up until 2025, one member of the board of directors was Eric Banoun, whom Israeli media outlet Haaretz described as “one of the pioneers of offensive cyber in Israel.” Banoun co-founded cyberespionage firm Circles, an NSO Group affiliate and Senpai Technologies, a part of spyware group Intellexa consortium. According to the Citizen Lab report, this proves a connection between Discover-Tech and the big players in the spyware industry.
Google and Interactive Advertising Bureau (IAB) listed Discover-Tech as “certified” or “approved” from 2020 until this month, when both delisted it after being told of the findings. The report says the companies which are allowed to be listed are vetted mainly based on self-attestation. Discover-Tech also used the GDPR consent framework to reach European users, so the privacy machinery meant to protect people helped legitimize the operation.
“It’s disastrous that major ad vendors and organizations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a senior researcher at Citizen Lab and one of the authors of the report. “Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.”
Citizen Lab analyzed nearly four billion bidding records that Discover-Tech left exposed in open databases, shut down in August 2026. Between March and June 2026 the company bid on about 3.77 billion impressions and won roughly 442 million. Its script-carrying ads appeared in about 75,000 apps and 120,000 websites. It is important to note that an impression is not an infection. Nevertheless, this number shows how many sensitive networks were reachable, among them NATO and UN networks, EU institutions, defense ministries and newsrooms such as AFP, RAI and Radio Free Europe/Radio Liberty.
“We assume that the large number of millions of ad impressions is the first step. It likely serves data collection and profiling. We don’t have evidence of additional infections, but it’s very likely that actual ad-based spyware infections occurred more often,” Christl told VSquare.
“Discover-Tech bridges the mercenary spyware industry with the online advertising ecosystem.” Source: Citizen Lab report, Figure 3
Czech Government Organizations Targeted by Discover-Tech Ads
The Israeli spyware firm Bindecy, which Citizen Lab links to Discover-Tech, has had a wholly owned Czech subsidiary, Shor Labs s.r.o., since 2025, and Bindecy’s co-founder Daniel Shapiro is a director. Czechia also appears among countries where Discover-Tech ads reached government networks, many of them defense, foreign affairs, interior and security bodies. It ranks ninth in the world by raw bids (19.1 million) and eighth per capita. Details about why Czechia appears so high on the list are unclear, as the top 10 countries are geographically spread across the whole world. Users tied to Candiru and Intelos also signed into Controlium from Czech locations.
The report also cites Recorded Future’s 2025 findings of Candiru infrastructure clusters linked to Hungary, and an Intelos-linked Controlium user signed in from there. German MEP Daniel Freund was targeted with Candiru spyware during the 2024 campaign and filed a criminal complaint against Viktor Orbán and unnamed persons. However, there are no known connections between Hungary’s government and Discover-Tech’s service.
Future of “AdFection”
“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system and a robust pipeline of valuable targets. Discover-Tech is surely just the tip of the iceberg,” said Bill Marczak, senior researcher at Citizen Lab and one of the co-authors of the report.
Today’s advertising ecosystem enables systematic misuse in two ways. First, the uncontrolled transmission of sensitive personal data through real-time ad auctions facilitates intrusive profiling and targeting. Second, the uncontrolled execution of third-party code attached to ads turns the websites and apps we use into security risks.
“If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether.”
The authors didn’t receive responses from Discover-Tech, Candiru/Integrity Labs, Bindecy and Intelos by the report’s deadline.
This analysis is based on a report by The Citizen Lab.
Subscribe to “Goulash”, our newsletter with original scoops and the best investigative journalism from Central Europe, written by Szabolcs Panyi. Get it in your inbox every second Thursday!
Tamara is a journalist from Slovakia, currently based in the Netherlands. Besides VSquare, she writes for The European Correspondent.
