TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Researchers from Citizen Lab and Confiant said Israeli firm Discover-Tech used online advertising technology to identify and potentially target mobile devices for spyware. Their analysis found the company’s ads across nearly 200,000 websites and apps, including sites belonging to European and international institutions; the researchers said this does not establish that all devices exposed were infected.
Researchers at the University of Toronto’s Citizen Lab and cybersecurity firm Confiant Threat Intelligence say an Israeli company used online advertising systems to identify and potentially target mobile phones for spyware, in an operation they named AdFection. Their analysis found the company’s ads across nearly 200,000 websites and apps, but researchers cautioned that devices directed to spyware-linked servers were not necessarily infected.
The investigation identified Discover-Tech, a company that describes itself as an advertising business, as central to the operation. Citizen Lab researchers said its platform, Controlium, enabled commercial spyware operators to identify, track and target devices through advertisements served on websites and mobile apps. The researchers linked the activity to Candiru, Israeli-made spyware that can be used to compromise devices.
Researchers analyzed four billion advertising records and found Discover-Tech ads on nearly 200,000 websites and apps in dozens of countries over a four-month period. Some ads appeared on institutional websites associated with NATO, the United Nations, the European Parliament, the European Commission and the Council of the EU. Their presence indicates those sites displayed the ads; it does not by itself show that the institutions’ networks or devices were compromised.
To investigate the operation, researchers examined devices belonging to journalists and staff at the Al Jazeera media network. They reported that 45 devices were targeted and that some were infected with Candiru spyware. The report said Discover-Tech’s ads directed millions of devices to servers associated with Candiru, a finding that may indicate broad targeting or reconnaissance. The researchers did not say that all devices routed to those servers were successfully infected.
How Ad Systems Can Enable Spyware
The reported technique changes the point at which a user may be exposed. Instead of relying on a victim to open a suspicious message or click a malicious link, the operation reportedly used ordinary ad-delivery systems to select devices and route them toward infrastructure associated with spyware. Researchers described this as a potential zero-click pathway, meaning a person may not need to take an obvious action for a device to be identified or targeted.
That matters because advertising networks distribute content across large numbers of websites and apps, including services that users and institutions may regard as routine. If commercial surveillance operators can use those systems for targeting, the risks extend beyond individual victims to journalists, public officials and others whose communications or movements could be sensitive. The report does not establish that every ad impression led to compromise, or that the named institutions themselves were hacked.
The findings also raise questions for the companies that operate or supply the advertising infrastructure. Real-time bidding systems process information to decide which ads are shown to which users. Researchers’ account suggests that this machinery may also offer spyware operators a way to locate potential targets at scale. The available report does not specify what information was collected from each device or how many people were ultimately affected.
mobile phone privacy screen protector
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Investigation’s Evidence
Citizen Lab is a University of Toronto research group known for investigating digital surveillance and spyware. For this report, its researchers worked with Confiant Threat Intelligence, analyzing advertising records and devices associated with Al Jazeera journalists and staff. The device findings provide evidence of targeting and, in some cases, infection; the broader advertising analysis documents the reach of Discover-Tech ads, not a count of confirmed infections.
The report says Candiru was linked to the campaign. The company was acquired in 2025 by Integrity Labs, according to the source report. Researchers said Discover-Tech presented itself as an advertising company while facilitating surveillance for commercial spyware operators. Discover-Tech and Integrity Labs had not responded to POLITICO’s requests for comment when the report was published.
The researchers’ terminology matters: “AdFection” is the name they gave to the ad-based infection technique. It is not presented as a name used by Discover-Tech. Likewise, the finding that ads appeared on major institutional websites does not establish that those organizations knowingly participated in the operation or that their systems were breached.
““Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system.””
— Bill Marczak, senior researcher at Citizen Lab
As an affiliate, we earn on qualifying purchases.
Exposure Is Not Confirmed Infection
The investigation’s figures do not establish how many phones were infected. Researchers said ads directed millions of devices to servers associated with Candiru, but that is not the same as confirming successful spyware installation. The report provides a specific finding of 45 targeted devices among Al Jazeera journalists and staff, with some infected, but does not give a total number of confirmed infections across the wider operation.
It is also unclear from the reported findings what data may have been collected from devices, how individual targets were selected, how many people were affected, or whether the operation remains active. The appearance of ads on NATO, UN and EU institutional websites does not show that those bodies’ internal systems were breached. Discover-Tech and Integrity Labs had not commented by publication, leaving their responses and any alternative account of the activity unavailable.
As an affiliate, we earn on qualifying purchases.
Investigations and Company Responses
The report triggered calls for further investigation, including from European Parliament lawmaker Hannah Neumann. The next questions for researchers and relevant authorities include whether the advertising activity is continuing, what information was exposed, and whether additional affected devices or operators can be identified.
Discover-Tech and Integrity Labs had not responded to POLITICO’s comment requests by the time of publication. Any company response, further technical analysis, or inquiry by European and other institutions could clarify the operation’s scope and the safeguards used by advertising platforms. For now, the central distinction remains: the researchers documented widespread ad placement and device targeting, while the full number of successful infections is unknown.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did researchers say happened?
Citizen Lab and Confiant said Israeli firm Discover-Tech used online advertising technology to identify and potentially target devices in an operation researchers named AdFection, which they linked to Candiru spyware.
Were millions of phones confirmed infected?
No. Researchers said ads directed millions of devices to servers associated with Candiru, but that does not confirm infection. Their report identified 45 targeted Al Jazeera staff and journalist devices, with some infected.
Why did the ads appear on institutional websites?
The researchers found Discover-Tech ads on websites associated with NATO, the United Nations and EU institutions. The report does not establish that those organizations knowingly hosted the operation or that their internal systems were compromised.
What is AdFection?
AdFection is the name Citizen Lab researchers gave to the ad-based technique they described. It uses online advertising systems to identify and potentially direct devices toward spyware-related infrastructure, rather than relying on a victim to click a malicious link.
What remains unknown?
The total number of successful infections, the data collected, the full set of targets and whether the operation is still active have not been established in the reported findings. Discover-Tech and Integrity Labs had not responded to requests for comment at publication.
Source: fediverse
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
