Ad Networks Weaponized for Zero-Click Mercenary Spyware Attacks
Discover-Tech's platform delivered silent spyware to high-profile targets via programmatic advertising.
1Ad Tech Surveillance Emergence
Citizen Lab and Confiant uncovered the first technical evidence of zero-click government spyware delivered directly through programmatic advertising networks. Israeli ad firm Discover-Tech served as an operational bridge, letting surveillance vendors quietly infect consumer and enterprise hardware globally without requiring user interaction or link clicks.
2Controlium Platform Mechanics
Discover-Tech operated a proprietary platform named Controlium to de-anonymize targets, fingerprint device environments, and push malicious payloads alongside legitimate ads. Surveillance operators selected targets using precise identifiers like IP addresses, mobile advertising IDs, and browser footprints to execute targeted zero-click device compromises.
3Critical Infrastructure Exposure
Security flaws in Discover-Tech's web portal exposed billions of ad-bidding records generated between March and June 2026. The dataset proved that malicious ad auctions reached devices on networks belonging to militaries, national cyber agencies, the International Criminal Court, and the International Atomic Energy Agency.
4Mercenary Spyware Integration
Unprotected login data and source code leaks confirmed active system access by employees from surveillance makers Candiru and Bindecy. Candiru, previously blacklisted by the United States government, leveraged Controlium's infrastructure to deploy zero-click exploits directly into active ad-bidding streams across thousands of apps.
5Targeted Newsroom Infiltration
Investigations confirmed that Candiru spyware compromised at least 45 Windows systems at Qatar-based media network Al Jazeera during 2024 and 2025. Malicious advertising payloads silently compromised the newsroom computers without triggering standard perimeter alarms or requiring staff to click compromised URLs.
6Government Attribution Gaps
Although researchers confirmed the operational roles of Discover-Tech and Candiru, Citizen Lab noted that the specific government clients funding these operations remain unidentified. The findings demonstrate how state actors exploit commercial real-time bidding ecosystems to bypass traditional endpoint safeguards and perimeter network protections.
7Industry Supply Chain Purge
Following the investigation, major ad exchanges began severing connections with Discover-Tech. Google and Comcast-owned Beeswax permanently removed the company from their ad platforms, while IAB Europe formally suspended Discover-Tech from its approved vendor registry to mitigate automated malware delivery risks.
8Defensive Endpoint Recommendations
Researchers emphasize that enterprise and high-risk users must adopt aggressive ad-blocking technologies to neutralize zero-click malvertising vectors. Security teams should enforce ad tracking restrictions, regularly reset mobile ad IDs, and filter programmatic ad exchanges across critical corporate networks and managed mobile endpoints.
Original article: TechCrunch — Ad Networks Weaponized for Zero-Click Mercenary Spyware Attacks