A groundbreaking investigation from Canada’s independent digital watchdog The Citizen Lab has exposed a sweeping global cyber surveillance campaign that leverages mainstream digital advertising infrastructure to deliver the notorious Israeli mercenary spyware Candiru to millions of devices, entirely without any action from the target. This marks the first publicly confirmed instance of zero-click mercenary spyware being distributed via targeted online advertisements, according to the organization’s official report published Thursday.
The investigation details that Discover-Tech, an Israeli firm that operates under the facade of a legitimate digital advertising company, actually acts as a front for major mercenary spyware operators, including Candiru, which recently rebranded to Integrity Labs following a 2025 acquisition by unsanctioned U.S. private equity firm Integrity Partners. Through its advertising operations, Discover-Tech placed targeted ads that forced millions of devices across dozens of countries to connect directly to Candiru-controlled servers, enabling covert tracking and deep digital reconnaissance of affected users.
Notably, the report confirms that between 2024 and 2025, at least 45 devices connected to Al Jazeera Media Network were specifically targeted in a string of these zero-click ad attacks commissioned by Discover-Tech. The company controls a proprietary platform called Controlium that enables its mercenary spyware partners to de-anonymize users, collect unique device fingerprints, and automatically deploy malware infections the moment an ad loads on a user’s device. No click, no interaction, and no action from the target is required for the infection to succeed, making these attacks nearly invisible to the average user.
Over a four-month monitoring period, Citizen Lab researchers recorded Discover-Tech’s ads running across nearly 200,000 distinct websites and mobile applications for both Android and iOS operating systems, spread across dozens of nations. Beyond its partnership with Candiru, the investigation also links Discover-Tech to two other known mercenary spyware actors: Intelos and Bindecy.
Candiru first drew international regulatory attention in 2021, when the U.S. government added the firm to its trade blacklist over findings that it engaged in activities that threatened U.S. national security and foreign policy interests. Candiru is not the first Israeli spyware firm to face such sanctions: it was added to the blacklist alongside the infamous NSO Group, another major mercenary spyware provider that has been linked to global surveillance of journalists, activists, and government officials.
This is not Candiru’s first documented targeting of independent Middle Eastern media outlets either. In 2021, it was revealed that the firm’s spyware had been used to target the independent news outlet Middle East Eye (MEE) and dozens of other regional websites. A 2020 investigation by cybersecurity firm ESET uncovered a multi-wave Candiru surveillance campaign running between April 2020 and August 2021 that focused heavily on targets with connections to the Middle East, particularly organizations and individuals focused on the conflict in Yemen.
A particularly troubling revelation from the new investigation is that Discover-Tech was listed as a certified, approved vendor by both Google and IAB Europe, the leading trade association for the European digital advertising industry. The company was able to place its malicious ads across major global ad networks including Google, Russian search giant Yandex, and ad platform Beeswax.
Wolfie Cristl, a senior researcher at The Citizen Lab, emphasized the systemic risk this campaign exposes to the global digital ecosystem. “The way online advertising works today is a systemic security threat,” Cristl told Reuters, noting that the risk extends equally to governments, private sector entities, civil society groups, and ordinary individual internet users.
Confiant, a New York-based advertising security firm, released a parallel independent report on the campaign the same day as The Citizen Lab. Jerome Dangu, Confiant’s co-founder, told reporters that Discover-Tech was deploying as many as 10 million malicious advertisements every day across the globe. Dangu explained that standard industry data-sharing practices, known as cookie matching, allowed the firm to track users even after they left websites or apps that ran its ads. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Following the publication of the two research reports, major digital ad platforms including Google, IAB Europe, and Beeswax have already moved to cut off Discover-Tech’s access to the global digital advertising market, halting its ability to run new malicious ads for the time being.