# Ad Networks Weaponized for Zero-Click Mercenary Spyware Attacks Discover-Tech's platform delivered silent spyware to high-profile targets via programmatic advertising. - **Source:** [TechCrunch](https://techcrunch.com) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/eed42881-c2cf-4ca0-bf5f-57b6d48c6428 ## Ad Tech Surveillance Emergence Citizen Lab and Confiant uncovered the first technical evidence of zero-click government spyware delivered directly through programmatic advertising networks. Israeli ad firm Discover-Tech served as an operational bridge, letting surveillance vendors quietly infect consumer and enterprise hardware globally without requiring user interaction or link clicks. ## Controlium Platform Mechanics Discover-Tech operated a proprietary platform named Controlium to de-anonymize targets, fingerprint device environments, and push malicious payloads alongside legitimate ads. Surveillance operators selected targets using precise identifiers like IP addresses, mobile advertising IDs, and browser footprints to execute targeted zero-click device compromises. ## Critical Infrastructure Exposure Security flaws in Discover-Tech's web portal exposed billions of ad-bidding records generated between March and June 2026. The dataset proved that malicious ad auctions reached devices on networks belonging to militaries, national cyber agencies, the International Criminal Court, and the International Atomic Energy Agency. ## Mercenary Spyware Integration Unprotected login data and source code leaks confirmed active system access by employees from surveillance makers Candiru and Bindecy. Candiru, previously blacklisted by the United States government, leveraged Controlium's infrastructure to deploy zero-click exploits directly into active ad-bidding streams across thousands of apps. ## Targeted Newsroom Infiltration Investigations confirmed that Candiru spyware compromised at least 45 Windows systems at Qatar-based media network Al Jazeera during 2024 and 2025. Malicious advertising payloads silently compromised the newsroom computers without triggering standard perimeter alarms or requiring staff to click compromised URLs. ## Government Attribution Gaps Although researchers confirmed the operational roles of Discover-Tech and Candiru, Citizen Lab noted that the specific government clients funding these operations remain unidentified. The findings demonstrate how state actors exploit commercial real-time bidding ecosystems to bypass traditional endpoint safeguards and perimeter network protections. ## Industry Supply Chain Purge Following the investigation, major ad exchanges began severing connections with Discover-Tech. Google and Comcast-owned Beeswax permanently removed the company from their ad platforms, while IAB Europe formally suspended Discover-Tech from its approved vendor registry to mitigate automated malware delivery risks. ## Defensive Endpoint Recommendations Researchers emphasize that enterprise and high-risk users must adopt aggressive ad-blocking technologies to neutralize zero-click malvertising vectors. Security teams should enforce ad tracking restrictions, regularly reset mobile ad IDs, and filter programmatic ad exchanges across critical corporate networks and managed mobile endpoints. ## Sources covering this story - [TechCrunch — Governments Using Online Advertising Networks to Deploy Zero-Click Spyware](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/) - [The Verge — Israeli Ad Tech Firm Linked to Zero-Click Spyware Attacks](https://www.theverge.com/tech/1011956/discover-tech-zero-click-ads-spyware) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._