Israeli Ad Firm Exploited Real-Time Bidding to Deploy Candiru Spyware
Zero-click infections via online advertisements target high-profile devices without requiring user interaction or clicks.
1Zero-Click Infection Mechanism
Citizen Lab researchers identified a sophisticated zero-click spyware attack vector targeting Al Jazeera devices. Unlike traditional malware requiring user interaction, this method infects devices simply by loading an online advertisement. The attack bypasses standard security protocols, as victims do not need to tap or click on any malicious links or files.
2Discover-Tech Role Identified
The Israeli firm Discover-Tech acted as an intermediary for spyware vendors, specifically Candiru. While presenting itself as a legitimate advertising company, it facilitated the delivery of malicious code through real-time bidding auctions. This setup allowed the firm to operate within the digital advertising ecosystem while masking its true, harmful intent.
3Targeted Execution via Bidding
The attack utilized real-time bidding to deliver payloads selectively. When an ad loaded, a script analyzed the device's ad ID and IP address against a target list. Only specific devices received the malicious code, while others were served standard ads, ensuring the harmful script remained invisible to ad-serving platforms and security scanners.
4Scale of the Operation
Between March and June 2026, researchers analyzed nearly four billion ad-bidding records to uncover the operation. Discover-Tech ads were identified across 70,000 mobile applications and 120,000 websites. This massive reach allowed the attackers to probe networks globally, including sensitive government and defense infrastructure, without triggering immediate alarms within the advertising industry.
5Impact on Global Networks
While Al Jazeera confirmed 45 infected devices, the ads also reached NATO, the US Department of Defense, and the International Atomic Energy Agency. Although Confiant found no evidence of successful infections within these specific government bodies, the exposure highlights the severe vulnerability of high-security networks to compromised digital advertising supply chains.
6Industry Response and Blacklisting
Following the investigation, Google and IAB Europe removed Discover-Tech from their approved vendor lists. Additionally, ad-tech companies including Beeswax, Vungle, and Eskimi have blocked or paused the firm. These actions represent a significant effort to sanitize the programmatic advertising ecosystem from entities facilitating state-level surveillance and spyware distribution activities.
7Historical Context of Candiru
Candiru, now known as Integrity Labs, was previously exposed by Citizen Lab in 2021. The US government blacklisted the company that same year due to its involvement in developing spyware. This latest incident confirms that the vendor remains active, leveraging new, more covert delivery methods to bypass international sanctions and restrictions.
8Regulatory and Security Implications
This case underscores the inherent risks within the real-time bidding infrastructure, which currently lacks sufficient oversight. Researchers have urged regulators to investigate potential legal breaches by the involved companies. As spyware vendors evolve, the advertising industry faces mounting pressure to implement stricter verification processes to prevent the weaponization of programmatic ad delivery.