[REVISION HISTORY]

Discover-Tech digital advertising spyware exploitation

Updated 3 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-18 18:53 UTC → 2026-10-19 01:55 UTC · added ~~removed~~

Researchers from Citizen Lab and Confiant have identified a cyber-espionage technique known as ‘AdFection,’ which utilizes digital advertising to deliver ‘zero-click’ spyware. This method allows devices to be compromised simply by loading an advertisement, requiring no user interaction. Investigations indicate that the Israeli advertising firm Discover-Tech acted as an intermediary, using its ‘Controlium’ platform to facilitate the delivery of spyware developed by Candiru (now Integrity Labs). By purchasing malicious ads through major networks including Google, Yandex, and Microsoft, attackers could identify and compromise specific devices. The malicious advertisements reportedly appeared on hundreds of thousands of websites and mobile applications, generating an estimated 10 million daily impressions. The attack reportedly exploits browser vulnerabilities, potentially a ‘use-after-free in the Skia graphics library,’ to infect devices. The surveillance has targeted a wide range of individuals and entities, including journalists, activists, and diplomats. Investigations confirmed that at least 45 devices belonging to Al Jazeera journalists were targeted between 2024 and 2025. Other identified targets include networks associated with international organizations such as NATO, the United Nations, the European Commission, the International Criminal Court, and the International Atomic Energy Agency. Government networks in countries including Uruguay, Brazil, and Mexico were also reached. Following these findings, Google and IAB Europe removed Discover-Tech from their vendor lists due to systematic policy violations. The spyware utilized in these campaigns is capable of accessing private messages, photos, emails, and phone calls, as well as activating device ~~microphones.~~ microphones, camera feeds, and location data.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.