• Home
• cyber security

A joint investigation by Citizen Lab and advertising security firm Confiant has linked Israeli digital advertising company Discover-Tech to the distribution of spyware through targeted online ads that can compromise devices without requiring users to click or interact with them. Researchers said the findings represent the first technical evidence they have identified of attacks carried out through targeted advertising using this method.

The investigation found that devices belonging to Qatar-based Al Jazeera news network were among the targets. Ads associated with Discover-Tech were used in 2024 and 2025 to deliver spyware linked to Candiru, an Israeli surveillance software developer listed on the US government's blacklist.

Discover-Tech presents itself as a conventional digital advertising agency. However, researchers say the company provides a channel for distributing malicious advertisements in cooperation with firms specializing in spyware development.

The company operates a platform called Controlium, which enables partners to identify millions of users, track device characteristics and select targets for cyberattacks or information gathering. The process can take place without any action from the victim, a technique known as a zero-click attack.

The platform allows targeting based on internet protocol (IP) addresses, mobile advertising identifiers and browser identifiers, helping operators select specific devices for surveillance or compromise.

At Least 45 Al Jazeera Devices Targeted

According to the investigation, advertising linked to Discover-Tech was used during 2024 and 2025 to deploy Candiru-associated spyware on devices belonging to Al Jazeera. Researchers estimated that at least 45 devices within the media organization were targeted over that period.

The findings highlight how digital advertising infrastructure can be repurposed to conduct targeted cyberattacks against individuals and organizations. Unlike conventional phishing campaigns, these attacks do not require victims to open a link, download a file or otherwise interact with malicious content.

Platforms Remove Discover-Tech

Following the investigation's disclosure, Google and Beeswax, a company owned by Comcast, removed Discover-Tech from their platforms. IAB Europe also suspended the company's inclusion on its list of approved vendors, according to a Reuters report.

Researchers urged digital advertising companies to strengthen security screening and monitor advertisements distributed through their platforms to prevent their infrastructure from being exploited to deliver spyware.

They also recommended that users at elevated risk of targeting use ad-blocking tools, disable advertising tracking and regularly reset mobile advertising identifiers to reduce the ability to track and target their devices.