Discover-Tech used targeted ads to deliver zero-click spyware

AdFection zero-click attack mercenary spyware digital advertising surveillance cyber espionage

Researchers from Citizen Lab and Confiant have uncovered a sophisticated cyber espionage campaign dubbed ‘AdFection’. The operation utilizes the legitimate digital advertising ecosystem to deliver mercenary spyware without requiring any user interaction.

At the center of the campaign is Discover-Tech, an Israeli advertising firm. Using its Controlium platform, the company reportedly used real-time bidding processes to identify and track targets, facilitating the delivery of Candiru spyware. The attack employs a ‘zero-click’ method, exploiting browser vulnerabilities—likely a use-after-free in the Skia graphics library—to infect devices simply by loading an advertisement.

Investigations confirmed that at least 45 devices belonging to staff at the international news network Al Jazeera were compromised between 2024 and 2025. The spyware is capable of exfiltrating sensitive data, including SMS, call logs, microphone audio, camera feeds, location data, and emails.

Beyond Al Jazeera, malicious advertisements were detected on networks used by high-profile international organizations, including the United Nations, NATO, the International Criminal Court, and the IAEA. In response to these findings, Google and IAB Europe have removed Discover-Tech from their approved vendor registries.

Entities

Al Jazeera · Candiru · Citizen Lab · Confiant · Discover-Tech · Google · NATO

Claims

What the coverage asserts, and how many sources carry each claim.

[● 11 SOURCES] Israeli digital advertising firm Discover-Tech has used its advertising infrastructure to facilitate user tracking and the deployment of spyware. www.takvim.com.tr · istokpress.mk · off.net.mk · www.gzt.com · kutahyaekspres.com · +6 more
[● 11 SOURCES] Spyware from the Israeli company Candiru was delivered via Discover-Tech ads to compromise 45 Windows devices at Al Jazeera. off.net.mk · kutahyaekspres.com · periodicoatico.com.ar · www.takvim.com.tr · conservativedailynews.com · +6 more
[● 2 SOURCES] The company's ads reach an estimated 10 million impressions per day globally. www.takvim.com.tr · off.net.mk
[● 3 SOURCES] Discover-Tech ads are displayed on more than 120,000 websites and 75,000 mobile applications. www.takvim.com.tr · off.net.mk · periodicoatico.com.ar
[● 3 SOURCES] The spyware can access messages, photos, emails, phone calls, and the device microphone. www.gzt.com · flagthis.com · kenya-today.com
[● 4 SOURCES] The company operates a platform called Controlium that enables mass profiling and identification of internet users. istokpress.mk · www.gzt.com · conservativedailynews.com · www.webnews.it
[● 7 SOURCES] Malicious ads have appeared on networks used by the UN, NATO, the International Criminal Court, and the IAEA. istokpress.mk · www.gzt.com · conservativedailynews.com · formiche.net · flagthis.com · +2 more
[● 13 SOURCES] The attacks utilize a zero-click method, meaning users do not need to click links or download files for their devices to be compromised. istokpress.mk · www.gzt.com · kutahyaekspres.com · conservativedailynews.com · www.malatyaguncel.com · +7 more
[● 13 SOURCES] Israeli company Discover-Tech used its Controlium platform to facilitate the campaign. zap.aeiou.pt · cybernoz.com · guik.pe · pplware.sapo.pt · sapo.pt · +7 more
[● 2 SOURCES] The attack exploited a browser rendering vulnerability, likely a use-after-free in Skia. flagthis.com · pplware.sapo.pt
[● 3 SOURCES] Google and IAB Europe disconnected Discover-Tech from their advertising systems. ascii.jp · pplware.sapo.pt · ppc.land
[● 7 SOURCES] At least 45 devices at Al Jazeera were targeted and infected with Candiru spyware. ascii.jp · cybernoz.com · flagthis.com · kenya-today.com · zap.aeiou.pt · +2 more