@wchr I worked in ad tech. To say it went "undetected" is incorrect: malicious ads & fraud were ok so long as they made money & no one important enough complained. One company I worked at made in the ballpark of 40% of their income off of fraud (refreshing ads in inactive tabs), though admittedly I was hired to reduce this (people important enough had complained). I can say with confidence through that the majority of ad impressions on the Internet are fraud.

What about the advertising industry?

It's disastrous that major ad vendors and organizations apparently were neither able to detect nor prevent the company's malicious advertising operations for years.

Cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting.

For example, mandate the removal of personal data from real-time ad auctions.

Digital advertising is broken. The way it works today is a security threat for states, the private sector, civil society and everyone else alike.

It's difficult, if not almost impossible, to consistently protect yourself from malicious ads. Our findings confirm that ad blocking must be considered a cybersecurity best practice.

What else? Disable the so-called Advertising ID on mobile devices, use opt-out features of apps, use a browser that blocks tracking, if possible block at network level.

More broadly, we've seen ad-based malware and we've also seen indications for ad-based spyware delivery, in reports on offensive capabilities offered by ADINT vendors and most profoundly, in Amnesty Security Labs' investigation into Intellexa's ad-based 'Aladdin' infection vector and the co-timed Google report:
https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/
https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue

To our knowledge, our report presents the first public technical confirmation of a zero-click mercenary spyware attack delivered via ads.

There's a lot of detail in our report, Controlium screenshots, tracking and ID syncing, Discover-Tech's corporate network, the history of its advertising tech, including odd stuff that may justify another investigation.

On a side note, part of what we found relied on Discover-Tech's own hilariously bad security.

A lot of information was publicly accessible without any authentication requirement, including ad bidding logs, source code for admin panels, ad encryption tools and even user logins.

In addition ad-based spyware from Candiru (now 'Integrity Labs'), we found that Discover-Tech is linked to additional surveillance firms including mercenary spyware vendor Bindecy and ADINT vendor Intelos.

We'll publish a follow-up report on another threat actor we call DARK CARTOGRAPHER that uses Discover tech ads to exploit vulnerabilities across mobile carriers in 30 countries to link device/ad IDs with phone numbers. This actor is linked to additional ADINT firms and a US govt contractor.

In addition to actual infections, we found 4 billion ad bidding records from Discover-Tech's MyDSP system.

From March to June 2026, hundreds of millions of their ads were shown to users of almost 200k different websites and apps.

Millions of people were at least subject to profiling, if not worse.

This includes users within IP networks of NATO, UN, EU institutions and a wide range of organizations in many countries including in defense, government, critical infrastructure, industry and media.

And this is how Discover-Tech facilitated a zero-click Candiru spyware infection:

1. Target user with a Discover-Tech ad with JavaScript code attached
2. Select user for validation? Connect to Candiru validator server
3. Select user for infection? Connect to Candiru infection server
4. Device infected? Connect to Candiru C&C server

Discover-Tech also received a lot of device and identity data using its impression and click tracking systems, whether a user was selected for infection or not.

We found that Discover-Tech delivered ads via Google, Yandex and other ad vendors including Beeswax (Comcast), Vungle (Liftoff), Eskimi and Sunteng.

Discover-Tech was listed as a 'certified' and 'approved' ad vendor by Google and the advertising industry association IAB Europe from 2020 until Oct 2026.

The ad vendor registries maintained by Google and IAB Europe helped make Discover-Tech appear to be a legitimate vendor and facilitated its participation in the advertising ecosystem at scale.

Discover-Tech operated a platform called 'Controlium' that enabled its spyware partners to profile and automatically infect devices when an ad was shown.

To make this work, they 'exploited' the real-time auction system that underpins targeting and data harvesting in today's digital advertising ecosystem. They also 'exploited' the ability to run code attached to ads in apps and browsers.

Discover-Tech operated its own ad buying platform called MyDSP and also used DSPs operated by other firms.

At the core of our report is the Israeli firm Discover-Tech Ltd, which presents itself as a 'legitimate' advertising firm but which we found operated as a bridge between surveillance vendors and the digital advertising industry.

As a result of the investigation, Discover-Tech has now been widely disconnected from the ads ecosystem.

Spionagesoftware per Online-Werbung

Eine Firma aus Israel soll mit Online-Werbung Spionagesoftware ausgespielt haben. Ziele waren mutmaßlich internationale Organisationen, Staaten, Medien und Unternehmen.

Das zeigt ein Bericht des @citizenlab, den wir zusammen mit @netzpolitik_feed vorab ansehen konnten.

„Die Online-Werbung ist kaputt“, sagt @wchr, der am Bericht beteiligt ist. Sie sei ein einziges Sicherheitsrisiko.

https://www.tagesschau.de/investigativ/br-recherche/spionage-software-werbung-100.html

#adtech

Sieht ein Opfer die Werbeanzeige, ist es schon zu spät. Forschende des @citizenlab zeigen erstmals im Detail, wie Angreifer mittels Online-Werbung Geräte mit einem Staatstrojaner hacken. Zero-Click-Infection. 🦠 ✨

Dazu Co-Autor @wchr: "Das Blockieren von Online-Werbung ist für die IT-Sicherheit obligatorisch."

- gemeinsam mit @roofjoke & @br_data konnte ich die Untersuchung vorab sichten, einordnen und Akteure konfrontieren.

https://netzpolitik.org/2026/werbeblocker-obligatorisch-handys-lassen-sich-ohne-klick-per-werbeanzeige-hacken/

My colleagues at the University of Toronto's @citizenlab and I spent more than a year on this.

Ad security firm Confiant published a parallel report:
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming

And check out the excellent media reports on our research:
https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/
https://www.nbcnews.com/tech/security/israeli-ad-company-helped-spyware-firm-target-al-jazeera-online-ads-re-rcna602999
https://www.ft.com/content/b857f1ed-8af6-4d64-b059-912afee1c075
https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say
https://www.forbes.com/sites/thomasbrewster/2026/10/15/israeli-spyware-ads-target-journalists/
https://www.bloomberg.com/news/articles/2026-10-15/israeli-firms-placed-spyware-at-al-jazeera-via-ads-report-says
https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/
https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
https://www.tagesschau.de/investigativ/br-recherche/spionage-software-werbung-100.html
https://netzpolitik.org/2026/angriff-auf-al-jazeera-der-trojaner-kam-per-online-werbung/
https://www.fanpage.it/attualita/banner-di-finte-pubblicita-cosi-unazienda-israeliana-ha-esposto-camera-e-difesa-ad-attacchi-spyware/

Discover-Tech, a company deeply embedded in the digital advertising ecosystem, weaponized ads to profile millions of people in many countries and to help infect 45+ devices within the news network Al Jazeera with Candiru spyware.

In this new @citizenlab report, we document the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted ads:
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

Very good: a clear decision about what's unlawful with ramifications for the broader adtech industry and RTB at large.

Less than ideal: 6 years until enforcement; low fine because the decision is about Norwegian users only and the fine is aligned with the turnover of Xandr, not with the turnover of its parent company Microsoft (previously AT&T).

Yesterday, the Norwegian GDPR regulator announced a fine against the Microsoft-owned surveillance advertising company Xandr for unlawfully transmitting data on Norwegian Grindr users to "potentially thousands of companies", based on an investigation I spent a lot of time on in 2019:
https://www.forbrukerradet.no/side/microsoft-company-fined-85-million-euros-following-complaint-by-the-norwegian-consumer-council-and-noyb/

Staatliche Behörden kaufen hochsensible Standort- und Verhaltensdaten über Milliarden von Apps und aus der Online-Werbung für Überwachungszwecke - in den USA, El Salvador, Ungarn und auch in Österreich.

Wie funktioniert das? Warum ist das (grund)rechtlich ein einziges Desaster? Mein 25min Vortrag letzte Woche auf der re:publica Wien ist online:
https://tube.moment.at/w/38HawnMtwBGwZ1eEB4NZFY

Staatliche Behörden kaufen hochsensible Standort- und Verhaltensdaten über Milliarden von Apps und aus der Online-Werbung für Überwachungszwecke - in den USA, El Salvador, Ungarn und auch in Österreich.

Wie funktioniert das? Warum ist das (grund)rechtlich ein einziges Desaster? Mein 25min Vortrag letzte Woche auf der re:publica Wien ist online:
https://tube.moment.at/w/38HawnMtwBGwZ1eEB4NZFY

Kirchen, Moscheen, Synagogen: Datenhändler gefährden Gläubige in Deutschland. Dahinter stecken frei verkäufliche Handy-Standortdaten der Werbe-Industrie. @roofjoke und ich haben mehr als eine Million Standortdaten an Glaubensorten gefunden. Fachleute warnen vor einer Gefahr für religiös motivierte Gewalt. Der ehemalige Vorsitzende des Deutschen Ethikrats, Peter Dabrock, ist „schockiert“.

Lest hier den neusten Teil der #DatabrokerFiles

https://netzpolitik.org/2026/kirchen-moscheen-synagogen-datenhaendler-gefaehrden-glaeubige-in-deutschland/