Israeli ad firm used online ads to deliver zero-click spyware, researchers say

Israeli advertising firm Discover-Tech used ordinary online ads to track people and install spyware to their devices, as per Reuters.

It was able to distribute ads across a vast network of websites and apps using advertising platforms operated by Google, Comcast and Yandex. Independent investigations by Citizen Lab and Confiant revealed how the operation worked. Simply loading an ad could expose users to surveillance or spyware, even without clicking on it.

Why a loaded ad was enough to compromise a device

Real-time bidding auctions ad space in milliseconds, sharing device and location data with potential buyers. Some ads also run code. Citizen Lab calls the zero-click spyware technique AdFection and links Discover-Tech to Candiru, an Israeli spyware maker blacklisted by the US in 2021.

On April 12, 2026, Confiant found a MyIPInfo banner, which redirected to an infrastructure linked to Candiru through Amazon CloudFront. The ad loaded a fake verification tool that have about 90KB of hidden JavaScript. This allowed it to collect information about the device and communicate through an encrypted channel. Confiant investigated the activity between April and September 2026.

45 infected machines at Al Jazeera, millions more exposed

Citizen Lab examined four billion bidding records. It found out that Discover-Tech had booked its advertisements on at least 120,000 online sites and in 75,000 applications.

As per Confiant’s estimation, there are at least 10 million advertisements delivered via Discover-Tech in a day. Its cofounder Jerome Dangu said “very likely hundreds of millions of people would have been touched by Discover-Tech.”

Citizen Lab confirmed that Candiru spyware compromised 45 Windows machines at Al Jazeera during 2024–2025. The broadcaster said it “condemns the spyware attacks targeting a number of its staff.”

Discover-Tech ads are also shown on networks associated with government and international agencies, including the Pentagon, United Nations, NATO, European Commission, International Atomic Energy Agency and International Criminal Court. Researchers also detected Discover-Tech ads on networks associated with chipmakers Nvidia, Broadcom and Micron.

However, exposure does not necessarily mean infection. Unlike the reported compromises at Al Jazeera, these appearances do not establish that spyware successfully infected devices at those institutions.

Google, IAB Europe and Beeswax cut off access

Google removed Discover-Tech from its advertising platform “for systematically violating our policies.” IAB Europe also dropped the ads company from its list of approved vendors. Comcast’s Beeswax blocked its access to the platform.

The findings raised wider concerns about online advertising security. Citizen Lab researcher Wolfie Christl warned that “the way online advertising works today is a systemic security threat.”

A $1.34 trillion market built on the same plumbing

The advertising market continues to grow, raising the stakes for security. WARC expects global ad spending to reach $1.34 trillion in 2026. In the US, programmatic advertising earned a staggering $162.4 billion in 2025 according to IAB numbers. But security measures have been unable to keep up with the increasing application of artificial intelligence in the advertising industry.

IAB research shows only about 40% of the surveyed ad buyers have already done or plan to do something regarding legal, security, and data risks related to AI-powered measurement.

Norway recently fined Microsoft-owned Xandr NOK 92 million for unlawfully sharing sensitive Grindr data through ad auctions. It was a privacy violation, not a spyware case. Regulator Line Coll said responsibility “cannot be passed on to others.”

The Discover-Tech case comes as advertising companies are increasingly investing in consumer data and AI-powered targeting. As Cryptopolitan previously reported, Publicis Groupe signed an agreement to buy LiveRamp for $2.2 billion, thus enhancing its AI-based marketing activities.

While the deal has no connection to the spyware attacks, it shows how important data and automation have become to the industry. The findings also raise questions about whether existing security measures are keeping pace.

Citizen Lab has called for investigations into Discover-Tech and Candiru, putting pressure on advertising platforms to improve how they screen vendors and detect malicious ads.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.