Researchers say an Israeli digital advertising company sold the plumbing that let a spyware operator slip surveillance code onto targets’ phones without a single click. The findings, reported October 15, 2026, describe a company called Discover-Tech, a Tel Aviv-based firm that sells online advertising services, and a platform it built called Controlium that researchers say let spyware operators identify, track and target specific devices through ordinary-looking ad placements.
The spyware maker on the other end, researchers say, was Candiru, an Israeli firm now reported to operate under the name Integrity Labs following an acquisition. The University of Toronto’s Citizen Lab led the technical investigation, with independent findings from the New York-based ad-security firm Confiant adding a second, separately sourced data set. Together, the two groups describe what Citizen Lab called “the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising,” according to the Wired report on the findings.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Researchers Say Happened
According to the reports, Discover-Tech’s advertising network carried the targeting ads across more than 120,000 websites and 75,000 apps through its advertising partnerships. The ads themselves looked unremarkable: researchers said some promoted everyday consumer products like phones and earbuds, the kind of creative that blends into any ad exchange’s inventory without raising flags. Behind the scenes, though, the ads were reportedly built to identify and track a device, and in some cases to attempt to extract a smartphone user’s phone number, according to NBC News.
The word “zero-click” is doing a lot of work in this story. It means the targeted person did not need to tap, swipe, or interact with the ad at all. Simply having the ad load within a browser or an app was reportedly enough for the targeting mechanism to engage. That distinction matters because it removes the one safeguard most people rely on without realizing it: the instinct not to click suspicious links. If merely loading a page is the exposure point, the usual advice about phishing awareness stops being useful.
Discover-Tech and the Controlium Platform
Discover-Tech is described in the reporting as a conventional-looking Tel Aviv digital ad company, the kind that sells placement and targeting services to publishers and advertisers like thousands of other firms in the programmatic ad business. Controlium is the platform researchers tied to Discover-Tech that allegedly gave spyware operators the targeting layer they needed: a way to identify a specific device within the ad bidstream, confirm it belonged to the intended target, and trigger the payload.
That is the part of this story that should worry anyone who works in ad tech or mobile engineering. Programmatic advertising already collects an enormous amount of device-level signal by design, because that signal is what makes targeted advertising valuable. Researchers allege Controlium repurposed that same signal pipeline, originally built for marketing, into a surveillance tool. The mechanics are not exotic. They are a misuse of infrastructure nearly every mobile app and website already plugs into.
For engineering teams, the uncomfortable takeaway is that an ad SDK is also a telemetry pipe, and telemetry pipes can be repurposed by whoever controls the server on the other end. That is a similar lesson to the one raised by exposed AI gateway infrastructure, where security researchers found a meaningful share of LiteLLM gateway instances left exposed to the open internet earlier this year â different stack, same underlying problem of trusted infrastructure becoming an attacker’s shortcut.
Candiru’s Path to Integrity Labs
Candiru has drawn scrutiny in past years as part of Israel’s offensive cyber sector, and researchers now say the company operates under the name Integrity Labs following an acquisition. Attaching a new corporate identity to spyware operations that have previously drawn public attention is a familiar pattern across that industry, and it complicates efforts by journalists, researchers and regulators to track accountability over time, since the entity doing the targeting today may not carry the same name a scrutiny report used two years ago.
None of the current reporting establishes a confirmed legal status for Candiru, Integrity Labs, or Discover-Tech beyond the research findings themselves â no criminal charge or court ruling is cited in the coverage reviewed for this story. What is attributed to named researchers is the technical link between Discover-Tech’s ad infrastructure and spyware payloads researchers associate with Candiru’s tooling.
How a Zero-Click Ad Attack Actually Works
To understand why this matters to anyone building or shipping mobile software, it helps to picture what a normal programmatic ad request already carries. A real-time bidding request routinely includes a device identifier, IP address, app or site context, operating system version, and sometimes more. That is the normal, disclosed business of ad tech. A simplified version of that kind of payload looks something like this:
{
"device": {
"ifa": "device-identifier-placeholder",
"os": "iOS 19.x",
"ip": "203.0.113.42",
"ua": "Mozilla/5.0 (iPhone; CPU iPhone OS...)"
},
"app": { "bundle": "com.example.newsreader" },
"geo": { "country": "QA" }
}That is illustrative, not a leaked artifact from the investigation â none of the reports reviewed published Discover-Tech’s actual payload structure. But it shows why researchers describe the technique as powerful: the targeting logic hides inside data an ad exchange is already supposed to be collecting. A malicious actor does not need to trick a user into installing anything. They need control over which ad gets served to which device identifier, and a payload that activates once it confirms it has reached the right device.
Al Jazeera in the Crosshairs
Citizen Lab’s reporting centers on Al Jazeera, the Qatar-based news organization. Researchers said at least 45 devices belonging to Al Jazeera journalists and staff were targeted during 2024 and 2025. That is a two-year window, not a single incident, suggesting a sustained operation rather than an isolated test. Al Jazeera journalists have been named in past spyware investigations tied to other vendors, and researchers’ decision to publish this particular case in detail reflects the organization’s long-running role as a tracked target for Citizen Lab’s research into press-freedom-related surveillance.
The targeting of journalists specifically raises the stakes beyond a typical ad-fraud or malware story. Spyware aimed at reporters threatens sources, unpublished reporting, and in some press-freedom cases, personal safety. That is the throughline connecting this story to years of prior mercenary spyware reporting involving other vendors and other outlets, even though this specific technical delivery method â through programmatic advertising rather than a malicious link or app â appears to be new.
Confiant’s Independent Numbers
Confiant, a New York-based advertising-security company, published a separate analysis that researchers say corroborates the broader pattern. That analysis reportedly examined four billion advertising records and found the suspicious ads running across almost 200,000 websites and mobile apps over a four-month period, according to Forbes. Confiant’s figures are a different measurement than Citizen Lab’s 120,000-site, 75,000-app partnership number, and the two should be read as complementary rather than identical: one describes the scale of Discover-Tech’s ad distribution footprint, the other describes a records-based sample pulled from bidstream data over a defined window.
Two independently resourced research teams arriving at overlapping conclusions through different methodologies is part of why this story is being treated as credible and significant rather than a single-source claim. It mirrors how security researchers increasingly validate major findings â through parallel analysis rather than a single disclosure.
Key Figures From the Investigation
| Metric | Reported Figure | Source |
|---|---|---|
| Websites carrying Discover-Tech ads | 120,000+ | Researcher reporting, via multiple outlets |
| Apps carrying Discover-Tech ads | 75,000+ | Researcher reporting, via multiple outlets |
| Ad records in Confiant’s separate analysis | 4 billion | Confiant |
| Sites/apps in that separate analysis | ~200,000 | Confiant / researcher reporting |
| Analysis time window | 4 months | Confiant / researcher reporting |
| Al Jazeera devices targeted | At least 45 | Citizen Lab |
| Targeting period | 2024 and 2025 | Citizen Lab |
| Attack classification | Zero-click | Citizen Lab / Confiant |
Two figures circulating around this story are not confirmed by the strongest sourcing reviewed here and should be treated with caution. A claim of at least 10 million ads served daily appears in secondary coverage but is not corroborated in the primary Citizen Lab or Confiant material. Likewise, a broader claim that the operation affected “millions of phones” conflates devices directed toward Discover-Tech-linked servers with devices confirmed to be infected â the available reporting establishes the former at scale, not the latter.
The Ad Exchanges Involved: Google, Beeswax and Yandex
Reports name three advertising platforms connected to the distribution chain: Google, Beeswax â a Comcast subsidiary â and Yandex, according to Politico. Being named as a platform through which the ads moved is not the same as being accused of knowingly facilitating spyware delivery; programmatic advertising runs through many layers of automated exchanges, and malicious actors have a long track record of exploiting that automation to slip past review processes built for fraud and brand-safety concerns, not nation-state-grade targeting.
That said, the involvement of major ad exchanges puts pressure on the entire industry’s vetting processes. Ad-tech platforms have spent years building fraud detection aimed at bots and click farms. This case argues for a different category of defense: detecting targeting logic built to identify a specific device rather than to defraud an advertiser. Those are different problems, and the tooling built for one does not automatically catch the other.
Google has since confirmed it took action against the operation. A Google spokesperson told Tech Insider: “Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover Tech from our ad platforms for systematically violating our policies. We also set up Safe Browsing warnings to help protect people if they navigate to websites linked to this group.”
Two things in that statement are worth drawing out. The first is that Google places itself inside the investigation rather than alongside it, describing the work with Citizen Lab and Confiant as joint. The second is Safe Browsing: blocking the advertiser removes the delivery route from Google’s own platforms, but a Safe Browsing warning reaches users across every browser that consumes those lists, including people who arrive at Discover-Tech-linked infrastructure by some other path. That is a broader remedy than an ad-account ban, and it is the part that matters for anyone who may already have been exposed.
Why This Differs From Past Spyware Delivery Methods
Most mercenary spyware cases publicized in recent years have relied on a malicious link sent directly to a target, a compromised app, or a vulnerability chain in messaging software that required some form of interaction or network exploitation. What researchers describe here is different: the delivery mechanism is the open advertising ecosystem itself, the same pipes that serve ads to hundreds of millions of ordinary users every day. A target does not need to be singled out by a phishing message. They only need to browse a site or open an app that happens to serve ads through the compromised network, while the targeting logic running behind the scenes decides whether this particular device matches a target profile.
That is a meaningfully different threat model from the exploit chains security teams have been tracking through zero-day disclosures this year, including the three-flaw chain reported in Ivanti Connect Secure and Citrix NetScaler products and the critical-severity flaws logged against Cisco and SonicWall gear on CISA’s Known Exploited Vulnerabilities list. Those are software bugs patched with an update. An ad-delivered zero-click targeting system is closer to an abuse-of-infrastructure problem, and there is no single patch that closes it, because the infrastructure being abused is functioning exactly as designed for its intended, legitimate purpose.
Market and Industry Impact
Programmatic advertising runs on trust between publishers, ad exchanges, and brand advertisers that the automated pipeline connecting them is not being abused. A report alleging that a spyware operator used that pipeline to target journalists is the kind of finding that invites scrutiny from exchange operators, from brand-safety auditors, and potentially from regulators who oversee advertising technology and data protection. Expect ad exchanges named in the reporting to face pressure to explain their vetting of demand-side partners, and expect enterprise security teams to start asking vendors whether ad SDKs embedded in their own apps carry any exposure to this kind of abuse.
There is also a reputational dimension specific to Israel’s cyber industry. The country’s commercial spyware sector has already drawn years of international scrutiny, export restrictions in some jurisdictions, and lawsuits from technology companies and civil society groups. A new case tying a mainstream-looking ad company to a spyware vendor’s delivery chain adds to a body of evidence that policymakers in the United States and European Union have cited when debating tighter controls on commercial surveillance tools, a policy conversation that runs in parallel to Israel’s broader standing as a major technology exporter â a status also reflected in rankings like LinkedIn’s recent list of top Israeli startups, almost all of them unrelated to the spyware sector.
Historical Context: A Pattern of Israeli Spyware Scrutiny
This is not the first time an Israeli-linked spyware vendor has faced public research findings tying its tools to the targeting of journalists or civil society figures. Citizen Lab in particular has published a long run of similar investigations over the past decade, and mercenary spyware generally has become enough of a recurring policy issue that U.S. and European officials have discussed export controls and procurement bans aimed at the sector as a whole. What sets this investigation apart from most of that prior body of work is the delivery mechanism: advertising infrastructure rather than a messaging exploit or malicious app, a distinction researchers describe as a new technical milestone rather than simply another vendor added to an existing list.
Investigation Timeline
| Period | Development |
|---|---|
| 2024â2025 | At least 45 Al Jazeera journalist and staff devices targeted via zero-click ads, per Citizen Lab |
| Four-month window (date range not specified in reporting) | Confiant’s separate analysis reviews 4 billion ad records across roughly 200,000 sites and apps |
| October 15, 2026 | Citizen Lab and Confiant findings reported publicly, naming Discover-Tech, Controlium and Candiru |
| October 15, 2026 | Candiru identified in reporting as now operating as Integrity Labs following an acquisition |
What Security Teams and Developers Should Do Now
For engineering and security teams, the practical response to this story is less about panic and more about inventory. Teams that ship apps carrying third-party ad SDKs should know exactly which networks those SDKs route through, what device-level data those SDKs collect, and whether any of that routing touches exchanges named in active research into abuse. High-risk users â journalists, activists, legal and policy staff at organizations likely to be surveillance targets â benefit most from mobile threat-detection tools and regular device forensics rather than from avoiding specific websites, since the exposure here is not tied to visiting a “bad” site in the traditional sense.
This also strengthens the case for network-level anomaly detection rather than relying solely on endpoint antivirus signatures, a gap that vendors like Darktrace, Vectra and ExtraHop have built their businesses around in the enterprise space. Consumer-grade protection against this specific technique is thinner, which is part of why Citizen Lab’s research-driven disclosure model â publish findings, notify affected parties, push for platform-level fixes â remains the primary defense available to most targets right now.
Predictions: What Happens Next
- Expect the named ad exchanges to publish statements describing their response and any partner suspensions, given the reputational exposure of being named in a spyware-delivery investigation.
- Expect additional press-freedom organizations to request forensic reviews of staff devices, following Al Jazeera’s example, given how widely Discover-Tech’s reported distribution footprint extended.
- Expect renewed legislative attention in the U.S. and EU to commercial spyware export controls, building on years of prior debate that this case is likely to be cited in.
- Expect ad-security firms and mobile threat-intelligence vendors to publish detection signatures aimed specifically at ad-delivered zero-click targeting, treating it as a distinct category from existing ad-fraud detection.
- Expect scrutiny of Candiru’s rebrand as Integrity Labs to continue, as researchers and journalists test whether the corporate change reflects substantive operational changes or primarily a naming shift.
None of these predictions are confirmed outcomes â they are reasonable expectations based on how comparable spyware disclosures have played out in past years, and they should be read as analysis, not reporting of events that have already happened.
Frequently Asked Questions
What is Discover-Tech?
Discover-Tech is an Israeli digital advertising company, based in Tel Aviv, that researchers say sells online advertising services and built a platform called Controlium that was allegedly used to help identify and target specific devices through ads.
What is Controlium?
Controlium is the platform attributed to Discover-Tech that researchers say enabled spyware operators to identify, track and target devices through advertising placements, effectively turning ad-targeting infrastructure into a surveillance tool.
Who is Candiru, and what is Integrity Labs?
Candiru is an Israeli spyware company that researchers linked to the spyware delivered through Discover-Tech’s advertisements. Reports say Candiru now operates under the name Integrity Labs following an acquisition.
How can an ad infect a phone without anyone clicking it?
Researchers describe the attacks as “zero-click,” meaning the targeting and payload delivery process could reportedly trigger simply from the ad loading on a device, without the user tapping or interacting with it.
Who was targeted in this investigation?
Citizen Lab’s published findings center on Al Jazeera, saying at least 45 devices belonging to journalists and staff were targeted during 2024 and 2025.
Which advertising platforms were named in the reports?
Reports name Google, Beeswax (a Comcast subsidiary), and Yandex as platforms through which the ads reportedly moved, without accusing those platforms of knowingly facilitating spyware delivery.
Does seeing one of these ads mean a phone was infected?
Not necessarily. Reports describe large numbers of devices being directed toward Discover-Tech-linked infrastructure, but the available reporting does not establish that every device reached was successfully compromised, only that confirmed targeting occurred in specific documented cases such as the Al Jazeera devices.
What should high-risk users do to protect themselves?
Security researchers generally recommend mobile threat-detection tools, periodic professional device forensics for people in high-risk roles such as journalism and civil society work, and keeping operating systems fully updated, since this technique does not depend on tricking a user into clicking a malicious link.
Related Coverage
- Law Firm Data Breaches Hit Holland & Knight, 14 Clients [2026]
- South Korea Megachurch Probe Widens: 2nd Church, 960K Hit [2026]
- Swiss Pension Fund Publica Breach: 0 Payments Hit [2026]
- X Purges 13,000 Accounts Tied to Iran, Russia, China [2026]
- Microsoft, Japan Take Down Network Behind 1B Scams [2026]
