Citizen Lab and Confiant uncovered that Israeli firm Discover-Tech turned online ads into a zero-click spyware pipeline named AdFection.
A comprehensive joint investigation conducted by the University of Toronto’s Citizen Lab and U.S.-based ad-security firm Confiant has uncovered a massive, global digital surveillance operation that weaponized the multi-billion-dollar online advertising ecosystem. According to the researchers, an Israeli digital advertising agency named Discover-Tech utilized automated programmatic advertising infrastructure to convert routine banner advertisements into delivery mechanisms for zero-click mercenary spyware.
The sophisticated exploitation technique—designated as “AdFection” by the research teams—highlights how automated split-second digital ad auctions have evolved from standard privacy nuisances into significant national security and international espionage threats.
How the AdFection Infrastructure Operated
Programmatic advertising functions through automated, split-second auctions where advertisements are purchased and served instantly to users browsing websites or mobile applications. Discover-Tech allegedly manipulated this system by operating a proprietary platform called Controlium, which served as a control-panel interface for mercenary surveillance clients.
Between March and June alone, Discover-Tech placed nearly four billion ad bids. These advertisements—frequently disguised as common consumer products like smartphones and headphones, or unauthorized branding from third-party companies such as Amazon and AliExpress—surfaced across approximately 120,000 websites and 75,000 mobile applications.
Unlike traditional phishing attacks that depend on user interaction, Discover-Tech’s advertisements were engineered to execute hidden JavaScript code the moment an ad loaded in a browser or application background. This hidden code fingerprinted the target device, extracted network data including public IPv6 addresses and cookies, and assessed whether the target matched a specific surveillance profile. When a match was confirmed, the ad functioned as a bridge, communicating with external validator servers to facilitate a full zero-click spyware infection.
High-Profile Victims and Sensitive Networks
While the malicious advertisements appeared globally across mainstream news outlets, hobby applications, and casual websites, telemetry data indicated they also reached high-security networks. Researchers confirmed that AdFection techniques were actively deployed to target and compromise devices belonging to journalists at international media network Al Jazeera.
Furthermore, telemetry from Confiant showed that Discover-Tech’s ads surfaced on networks linked to the Pentagon, NATO, the United Nations, the European Commission, the International Criminal Court (ICC), and the International Atomic Energy Agency (IAEA), alongside government offices across roughly two dozen nations. Cybersecurity experts emphasized that an ad surfacing on a network does not automatically confirm a successful breach, but it underscores the vast scale and precision of the infrastructure.
Mercenary Spyware Connections and Industry Backlash
Investigators tied Discover-Tech’s infrastructure directly to Candiru, an Israeli commercial spyware vendor that was previously blacklisted by the United States Commerce Department. Connections were also identified linking Discover-Tech to other offensive cyber and Advertising Intelligence entities, such as Bindecy and Intelos. Furthermore, corporate records indicated that between 2020 and 2026, Discover-Tech’s shareholders included a corporate entity linked to Sara Hamou, who previously managed the corporate network of Intellexa.
Following the publication of the findings by Citizen Lab and Confiant, major technology corporations and ad-exchanges moved quickly to sever operational ties. Google completely terminated Discover-Tech’s access to its ad exchange platforms. Additional ad-tech platforms, including Beeswax, Vungle/Liftoff, and Eskimi, blocked Discover-Tech accounts, paused access, and removed them from their ad-buying networks.
Security researchers noted that standard ad-verification tools frequently failed to detect Discover-Tech because the ads dynamically altered their behavior, appearing entirely harmless to ordinary users while deploying payloads exclusively to pre-identified targets. In response, cybersecurity authorities are advising high-risk individuals, government bodies, and defense organizations to deploy robust ad-blocking software as a critical baseline defense against state-sponsored espionage.
Read also:CICA Summit Walkout: Delegations Exit As Israel’s Herzog Speaks
The Diplomatic Wire Desk is the institutional news and analysis body of Diplomatic Wire, overseen by Founder and Editor Khalid Minhas. The Desk covers international relations, foreign policy, and critical diplomatic initiatives with objective, timely reporting for a professional readership.
