An Israeli surveillance firm has been caught running a massive operation that uses online advertisements to infect mobile devices with spyware. Researchers from the University of Toronto’s Citizen Lab and the cybersecurity firm Confiant Threat Intelligence revealed this technique on Thursday, Politico reports.
The researchers discovered that the Israeli company, Discover-Tech, weaponized legitimate online ad systems to facilitate espionage. By leveraging these systems, spyware manufacturers could connect to millions of devices to identify, track, and target specific victims.
This method is particularly alarming because it exploits real-time bidding, the automated system used by platforms like Google to sell advertising space and target users. You don’t even have to click a malicious link to be compromised. The attackers can use these advertisements to identify and potentially infect devices without any user interaction, which is known as a zero-click infection.
The researchers uncovered these details after analyzing devices belonging to staff at the Al Jazeera media network
They found that 45 devices were targeted, with some successfully infected by an Israeli-made spyware program called Candiru. Integrity Labs, which acquired Candiru in 2025, was also linked to this activity. The platform used to facilitate this surveillance is called Controlium, which allegedly allowed operators to target devices by loading ads on websites and apps.
The scale of this operation is honestly staggering. An analysis of four billion advertising records showed that Discover-Tech ads appeared on nearly 200,000 websites and mobile apps across dozens of countries over a four-month period. Perhaps most concerning is that these ads appeared on institutional sites for the United Nations, NATO, the European Parliament, the European Commission, and the Council of the EU.
While researchers noted that Discover-Tech’s ads directed millions of devices to servers associated with Candiru, it doesn’t necessarily mean every single one of those devices was infected. Still, the potential for large-scale reconnaissance is massive.
Bill Marczak, a senior researcher at The Citizen Lab, pointed out that the findings are “surely just the tip of the iceberg” regarding how online ads are being abused for espionage. He noted, “Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system.” It’s a clever, if incredibly dangerous, use of the infrastructure that powers most of the internet today.
The discovery has already sparked significant concern in political circles. Hannah Neumann, a German European Parliament lawmaker, highlighted the vulnerability of democratic institutions. She said, “The possibility that EU institutions have been exposed should set off alarm bells across Brussels.” Neumann also stated, “Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware.”
The Citizen Lab is a well-known research group that has previously uncovered high-profile spyware scandals, including those targeting Catalan political figures and the associates of murdered journalist Jamal Khashoggi.
Discover-Tech and Integrity Labs did not immediately respond to requests for comment regarding these findings.
Published: Oct 16, 2026 09:15 am