Mercenary Spyware Weaponizes Global Ad Tech for Zero-Click Infections
Citizen Lab exposes how targeted digital ads delivered Candiru spyware without user interaction.
1First Proof of Ad-Delivered Spyware
Citizen Lab has published the first technical confirmation of mercenary spyware infecting real devices via targeted online ads. The zero-click operation infected at least 45 devices at Al Jazeera across 2024 and 2025. Unlike traditional phishing, the malicious payload executed silently when custom-created digital ads rendered in browsers.
2Two-Stage Infrastructure Bypasses Filters
Israeli advertising firm Discover-Tech deployed seemingly benign ads carrying lightweight callback scripts. When loaded, the ad sent the device's advertising ID and IP address to Discover-Tech's Controlium servers. Only pre-selected targets received browser exploits, while non-targets received nothing, leaving ad networks with no malicious code to detect.
3Direct Attribution to Candiru
Network traffic logs provided by Al Jazeera showed a consistent three-step infection sequence: contacting Discover-Tech ad servers, screening by Candiru infrastructure, and connecting to command-and-control servers. A recovered Windows binary shared unique code signatures with a Candiru tool that Citizen Lab had previously analyzed and dismantled in 2021.
4Corporate Rebranding Evades Sanctions
The United States blacklisted Candiru in 2021 for targeting journalists and activists. In 2025, U.S. investment firm Integrity Partners acquired Candiru's assets and restructured them under Integrity Labs, a newly formed entity outside existing sanction designations. Meanwhile, Discover-Tech operated under Dekel Boni, maintaining official ad-vendor approvals since 2020.
5Massive Reach Across Sensitive Networks
Discover-Tech placed nearly four billion bids between March and June 2026 across 75,000 mobile applications and 120,000 websites. Confiant recorded roughly 10 million daily ad impressions. Callback-enabled ads appeared on networks belonging to NATO, the UN, EU bodies, the ICC, IAEA, and government offices in two dozen nations.
6Pinpoint Profiling Versus Broad Delivery
While Discover-Tech served ads globally across countries like Brazil, Mexico, and Yemen, actual spyware payloads remained strictly controlled. Confiant observed that Candiru-linked exploits were delivered in low volumes, primarily reaching mobile and home internet connections rather than institutional networks, demonstrating surgical targeting within an otherwise massive programmatic ad funnel.
7Ad Exchanges Sever Vendor Access
Following Citizen Lab's report, major ad-tech platforms terminated Discover-Tech's operational access. Google and IAB Europe revoked approved vendor statuses held since 2020. Google barred the company from its ad exchanges for policy violations, Comcast's Beeswax removed access, Eskimi blocked all associated accounts, and Vungle paused integration pending review.
8Programmatic Ecosystem Needs Immediate Oversight
This investigation exposes fundamental vulnerabilities within real-time bidding systems, where unregulated data harvesting enables precise surveillance. Citizen Lab and Confiant published indicators of compromise for network defenders. Researchers argue that without structural regulatory reform across US and European ad tech, automated digital advertising will remain a stealthy vector for state-sponsored hacking.