Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [ACTIVE] · [TECHNOLOGY]
2 clusters · 83 sources · 3 days · First seen · Last updated
Discover-Tech digital advertising spyware exploitation
Overview
Researchers from Citizen Lab and Confiant have identified a cyber-espionage technique known as ‘AdFection,’ which utilizes digital advertising to deliver ‘zero-click’ spyware. This method allows devices to be compromised simply by loading an advertisement, requiring no user interaction.
Investigations indicate that the Israeli advertising firm Discover-Tech acted as an intermediary, using its ‘Controlium’ platform to facilitate the delivery of spyware developed by Candiru (now Integrity Labs). By purchasing malicious ads through major networks including Google, Yandex, and Microsoft, attackers could identify and compromise specific devices. The malicious advertisements reportedly appeared on hundreds of thousands of websites and mobile applications, generating an estimated 10 million daily impressions. The attack reportedly exploits browser vulnerabilities, potentially a ‘use-after-free in the Skia graphics library,’ to infect devices.
The surveillance has targeted a wide range of individuals and entities, including journalists, activists, and diplomats. Investigations confirmed that at least 45 devices belonging to Al Jazeera journalists were targeted between 2024 and 2025. Other identified targets include networks associated with international organizations such as NATO, the United Nations, the European Commission, the International Criminal Court, and the International Atomic Energy Agency. Government networks in countries including Uruguay, Brazil, and Mexico were also reached.
Following these findings, Google and IAB Europe removed Discover-Tech from their vendor lists due to systematic policy violations. The spyware utilized in these campaigns is capable of accessing private messages, photos, emails, and phone calls, as well as activating device microphones, camera feeds, and location data.
Entities
Google · Citizen Lab · Candiru · Al Jazeera · Discover-Tech
Claims
What the coverage asserts, and how many sources carry each claim.
Coverage disagrees
Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.
-
"Discover-Tech's ads reached more than 120,000 websites and 75,000 apps." www.akhbrna.ae · dete.gr · israelpalestinenews.org
vs
"Discover-Tech's network placed ads on nearly 200,000 websites and applications." www.netcost-security.fr · defimedia.info · www.akhbrna.ae · www.e-radio.gr · elespecialitodigital.com · +1 more
The first claim asserts the network placed ads on nearly 200,000 websites and applications, while the second specifies a breakdown of more than 120,000 websites and 75,000 apps, which totals 195,000.
- [DISPUTED] Discover-Tech's network placed ads on nearly 200,000 websites and applications. www.netcost-security.fr · defimedia.info · www.akhbrna.ae · www.e-radio.gr · elespecialitodigital.com · +1 more
- [● 27 SOURCES] Citizen Lab identified Discover-Tech as an intermediary connecting spyware operators to advertising infrastructure. cybernoz.com · cyberinsider.com · www.theregister.com · bahamasspectator.com · elespecialitodigital.com · +22 more
- [● 27 SOURCES] The spyware infection can occur without any user interaction or clicking on the advertisement. elespecialitodigital.com · cyberinsider.com · www.theguardian.com · forbesliberia.com · www.blogspan.net · +22 more
- [● 27 SOURCES] The spyware used in the campaign is developed by the Israeli company Candiru. innovations.fr · www.sofx.com · www.economiematin.fr · www.zougla.gr · www.yenisafak.com · +21 more
- [● 20 SOURCES] Researchers from Citizen Lab and Confiant identified a new spyware delivery method named ‘AdFection’. www.akhbrna.ae · bahamasspectator.com · dete.gr · elespecialitodigital.com · forbesliberia.com · +15 more
- [● 18 SOURCES] At least 45 Al Jazeera devices were infected during 2024 and 2025. www.sofx.com · gigazine.net · innovations.fr · racin.mk · www.politiquematin.fr · +12 more
- [● 15 SOURCES] Discover-Tech operated via a platform called Controlium. www.sofx.com · www.economiematin.fr · gigazine.net · innovations.fr · racin.mk · +9 more
Timeline
-
[TECHNOLOGY] 22 sourcesDiscover-Tech used targeted ads to deliver zero-click spyware
A Citizen Lab investigation reveals the ‘AdFection’ technique, where Israeli firm Discover-Tech used targeted ads to deliver Candiru spyware via zero-click attacks, infecting Al Jazeera staff and UN/NATO-linked
-
[TECHNOLOGY] 63 sourcesDiscover-Tech used digital ads to facilitate zero-click spyware attacks
Researchers have exposed ‘AdFection,’ a zero-click spyware technique using digital ads to infect devices without user interaction, targeting Al Jazeera journalists and various international organizations.
Sources
aeiou.pt · akhbrna.ae · alaraby.co.uk · alhayatp.net · antiguatribune.com · ascii.jp · athina984.gr · bahamasspectator.com · barbadosgazette.com · bitnewsbot.com · blogspan.net · cafetorah.com · conservativedailynews.com · cyberinsider.com · cybernoz.com · defimedia.info · dete.gr · devdiscourse.com · dominicanrepublicpost.com · donanimhaber.com · drohnen.de · e-radio.gr · economiematin.fr · elespecialitodigital.com · flagthis.com · fonetech.cz · forbesliberia.com · formiche.net · freerepublic.com · gamesite.zoznam.sk · gargalianoionline.gr · geeknetic.es · gigazine.net · guik.pe · gzt.com · haitigazette.com · hipertextual.com · innovations.fr · israelpalestinenews.org · istokpress.mk · it-boltwise.de · jawapos.com · karar.com · kenya-today.com · kids.pplware.sapo.pt · kutahyaekspres.com · m.takvim.com.tr · malatyaguncel.com
This summary has been updated 3 times: see revision history