GoKawiilCitizen Lab finds Israeli ad firm Discover-Tech aided spyware attacks on Al Jazeera
Security researchers at Citizen Lab and Confiant say Discover-Tech, an Israeli ad tech company, helped deliver spyware through online ads that required no user interaction to infect devices. The report links Discover-Tech's 'Controlium' platform to Candiru, a blacklisted Israeli spyware maker, and says at least 45 Al Jazeera devices were targeted in 2024 and 2025. Google, Beeswax, and IAB Europe have since removed or suspended Discover-Tech from their platforms.
GoKawiil's interpretation of the reporting above, not reported fact.
This appears to be the first documented case of a zero-click spyware attack delivered purely through targeted advertising, which researchers suggest could reveal a new vulnerability in the online ad ecosystem for surveillance abuse. The findings may pressure ad platforms to tighten vetting of partners, since malicious actors could otherwise exploit legitimate ad infrastructure to profile and target specific individuals without detection. The case also underscores ongoing concerns about commercial spyware firms operating with limited oversight despite government blacklisting.
- Discover-Tech allegedly enabled zero-click spyware delivery via online ads, with no user action needed.
- Candiru-linked spyware reportedly targeted at least 45 Al Jazeera devices in 2024-2025.
- Google, Beeswax, and IAB Europe have removed or suspended Discover-Tech following the findings.
Source: theverge.com — Emma Roth, 2026-10-15
Published there as: “An Israeli firm is sending spyware through online ads, researchers say”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.