Research conducted by the Canadian cyber watchdog The Citizen Lab showed that the devices of millions of people were infected with Israeli mercenary spyware called Candiru via digital advertising that does not require user clicks.
The group reported in a report published on Thursday that this is the first publicly confirmed example of using zero-click mercenary spyware delivered through targeted advertising. The spyware was also aimed at devices associated with Al Jazeera Media Network.
According to the report, the Israeli company Discover-Tech, which presents itself as a legitimate advertising firm, actually works for partners involved in Israeli mercenary spyware such as Candiru. This company placed targeted ads that prompted millions of devices in dozens of countries to connect to Candiru servers for surveillance and intelligence purposes.
The Citizen Lab found that between 2024 and 2025, at least 45 devices within Al Jazeera were affected by a series of zero-click advertising attacks acquired by Discover-Tech.
Discover-Tech manages a platform called Controlium, which allows 'mercenary partners to de-anonymize, fingerprint, and automatically infect devices' immediately after an ad impression, even if the target user does not click.
Over a four-month period, Discover-Tech's advertising was displayed on nearly 200,000 unique websites and Android and iOS applications in various countries.
Besides Candiru, which was renamed Integrity Labs, Discover-Tech is also linked to other mercenary spyware actors, including Intelos and Bindecy.
In 2021, Candiru was blacklisted by the US government for 'engaging in activities contrary to the national security or foreign policy interests of the United States.' The renaming of Candiru occurred after it was acquired in 2025 by the US private investment firm Integrity Partners, which is not under US sanctions.
Discover-Tech appeared as a 'certified and approved' provider working with Google and the IAB Europe advertising industry association, placing ads in major networks, including Google, the Russian search engine Yandex, and the Beeswax platform.
Wolfie Cristl, a senior researcher at The Citizen Lab, told Reuters: 'The way online advertising works today represents a systemic security threat'—and this applies to governments, the private sector, civil society, and everyone else.
Jerome Dangu, co-founder of the New York advertising security firm Confiant, which also published a separate report on the matter on Thursday, noted that Discover-Tech daily placed at least 10 million advertisements worldwide, and data exchange agreements known as cookie matching allowed it to track people even outside the reach of its advertising.
Dangu speculated: 'Hundreds of millions of people were likely affected by Discover-Tech.'
The Israeli spyware firm NSO Group was also added to the US trade blacklist along with Candiru in November 2021 after the US concluded that foreign governments were acquiring its spyware and using it to spy on government officials, journalists, and other individuals.
Candiru was also used to target Middle East Eye and other websites in November 2021. An attack discovered by the online security firm ESET targeted the MEE website over two days in April 2020. This campaign affected another 20 websites in two waves: April-July 2020 and January-August 2021.
ESET reported that the targets were 'Middle East connections and a strong focus on Yemen and the surrounding conflict.' Following conclusions from two research groups, Google, IAB Europe, Beeswax, and other platforms have since cut off Discover-Tech's access to the digital advertising market.