Israeli Firms Used Ad Network for Covert Spyware Deployment, Report Finds

An Israeli company, Discover-Tech, exploited internet advertising systems to distribute spyware capable of silently infecting user computers, according to a study by Citizen Lab at the University of Toronto released on October 15. The targets of these attacks included employees of the Qatar-based Al Jazeera television network. Researchers found that Discover-Tech provided the infrastructure for Candiru, another Israeli firm known for developing spyware, to conduct targeted attacks. At least 45 Windows computers within Al Jazeera's network were compromised in this manner between 2024 and 2025. Network activity logs provided by Al Jazeera confirmed the infection of devices with Candiru's spyware. A key feature of the discovered technology, dubbed "AdFection" by researchers, is that it did not require users to click on ads or follow suspicious links; the malicious code could execute simply when an advertisement was displayed on a website or in a mobile app. Discover-Tech allegedly used standard ad auctions to gather device information, identify owners, and select targets for infection, utilizing its Controlium platform for operations. The scope of Discover-Tech's activities extended far beyond the Al Jazeera attacks. Analysis of nearly four billion ad auction records from March to June 2026 revealed that Discover-Tech's ads appeared on over 120,000 websites and in 70,000 mobile apps globally. These ads were displayed on devices within networks of government agencies, defense departments, NATO, and other international organizations, though researchers stressed that ad display alone does not confirm spyware infection, and some instances may have only involved data collection. In response to the findings, Google has revoked Discover-Tech's access to its advertising platforms, and IAB Europe has removed the company from its list of approved vendors. Other ad market participants, including Comcast's Beeswax platform, have also imposed restrictions. Candiru, now operating as Integrity Labs, was previously sanctioned by the U.S. Department of Commerce in 2021 for developing spyware used to target journalists, activists, and government officials. Discover-Tech and Candiru did not respond to requests for comment. The identities of those who commissioned the Al Jazeera attacks remain unknown, and the study found no evidence that the operations were directed by Israeli state authorities.