A report from Citizen Lab describes a campaign in which an Israeli-registered ad company, Discover-Tech, acted as a bridge between online advertising and spyware makers. According to the researchers, malicious code loaded when an ad appeared, and the targets did not need to click. At least 45 Al Jazeera devices were infected with Candiru spyware in 2024 and 2025. The reports agree this is the first public technical evidence of mercenary zero-click spyware delivered through targeted ads.
The findings highlight a business failure in ad-tech vetting. Google and IAB Europe had listed Discover-Tech as an approved vendor since 2020. After Citizen Lab and Confiant shared their investigation, Google terminated access and IAB Europe suspended it; Beeswax, Vungle, and Eskimi also acted. The sources differ on breadth: TechCrunch says at least two spyware makers, Candiru and Bindecy, used the platform, while other coverage focuses on Candiru as the confirmed vendor.
The ad-buying system itself made the targeting possible. Real-time bidding sends device data to advertisers, and Discover-Tech used that data to decide whether a given user was a target. Citizen Lab said its ads ran in tens of thousands of apps and websites, including networks of governments, NATO, and other institutions, though appearing on those networks is not proof of infection. Defenders can block published indicators and look for the connection pattern described in the report.