How Israeli spyware firms turned online ads into weapon to hack journalists

TORONTO (MNTV) — For years, surveillance firms have hunted their targets with malicious links and booby-trapped messages.

Researchers have now documented something more insidious: spyware delivered through the ordinary online advertisements that follow internet users across the web, requiring the victim to do nothing at all.

In a report published on October 15, the University of Toronto’s Citizen Lab — the digital-rights watchdog that has exposed much of the global spyware industry — detailed what it says is the first publicly confirmed instance of mercenary spyware being deployed through targeted ads.

The technique, which the researchers named “AdFection,” turns the vast, automated advertising system that funds the internet into a precision weapon for hacking.

At the centre of the operation is an Israeli advertising-technology company called Discover-Tech, based in Tel Aviv.

Outwardly, it presents itself as a legitimate ad firm. In reality, Citizen Lab concluded, it functions as a “bridge between ad vendors and the mercenary spyware ecosystem” — selling surveillance operators access to the ad industry’s extraordinary reach.

Discover-Tech operated an ad-buying platform, MyDSP, alongside a separate dashboard called Controlium that allowed clients to select specific individuals for profiling or infection using their mobile advertising identifiers, browser cookies, and IP addresses.

The mechanics were chillingly simple. When a targeted person visited a website or opened an app, Discover-Tech would win the automated auction to show them an ad.

That ad carried a small script that called back to a Discover-Tech server, which checked the device against its target list. For a selected victim, the server returned code that routed the device — invisibly, with no click required — to spyware infrastructure.

Spyware and victims

The spyware delivered this way was Candiru, the notorious Israeli surveillance firm blacklisted by the US Commerce Department in 2021 for supplying tools used to target journalists, activists and officials, and now rebranded as Integrity Labs.

Citizen Lab attributed the attacks to Candiru with high confidence, citing infrastructure fingerprints and distinctive similarities — including its persistence mechanism and string obfuscation — to spyware recovered in 2021.

The confirmed victims were journalists.

Working from network logs supplied by Al Jazeera, which had launched its own internal probe after noticing suspicious activity, Citizen Lab traced the compromise of 45 Windows devices inside the Qatari broadcaster’s network across 2024 and 2025.

The logs showed the same signature each time: contact with a Discover-Tech domain, then a Candiru validator server, then a Candiru command server. The Palestinian territories, the researchers found, were especially saturated with Discover-Tech’s reach.

Sale and carelessness

The scale of the infrastructure is staggering.

Examining nearly four billion publicly exposed ad-bidding records from March to June 2026 alone, Citizen Lab found that Discover-Tech placed roughly 3.77 billion bids and won some 442 million auctions.

Its ads appeared across more than 75,000 mobile apps and 120,000 websites — close to 200,000 digital properties in dozens of countries.

Strikingly, the operation was also sloppy. Citizen Lab found a portion of Discover-Tech’s own site publicly accessible without a password, exposing login records for 120 of the platform’s operator-clients for 128 days.

A separate report by the New York advertising-security firm Confiant widened the alarm, finding Discover-Tech ads had surfaced on sensitive networks including the Pentagon, the UN’s International Atomic Energy Agency, and the International Criminal Court, as well as those of major chip companies.

Structural failure

Discover-Tech had not needed to sneak in. Google and the industry body IAB Europe had listed it as an approved advertising vendor since 2020, apparently unaware of how that access was allegedly being used.

Following the disclosures, Google terminated Discover-Tech’s access and removed it from its vendor lists; IAB Europe suspended it after an audit. Discover-Tech and Candiru did not respond to the researchers’ requests for comment.

For Citizen Lab, the case is a warning that reaches far beyond one firm. The abuse, it wrote, illustrates structural flaws in an online advertising system that failed entirely to detect or prevent it — and the lab’s researcher Bill Marczak cautioned that Discover-Tech is “surely just the tip of the iceberg.”

Their blunt advice to the public reframed a everyday browser tool as a security necessity: ad-blocking, they said, must now be considered a cybersecurity best practice.