Israeli firm weaponized digital ad network for spyware attacks, research shows

Israeli digital advertising firm Discover-Tech weaponized a vast commercial ad network to harvest personal data and deliver mercenary spyware to targeted devices worldwide, Canadian cyber watchdog Citizen Lab and New York-based ad security firm Confiant reported Thursday, Anadolu reports.

“The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting,” Confiant said in its investigative findings.

The coordinated operation enabled US-blacklisted Israeli spyware company Candiru, rebranded as Integrity Labs, and surveillance vendor Intelos to exploit commercial ad inventory across major global platforms, including Google, Beeswax and Russia’s Yandex, to track targets and compromise consumer devices.

Citizen Lab described the campaign as the first public technical confirmation of zero-click mercenary spyware delivered through online advertising, a method researchers termed “AdFection.”

Devices belonging to staff at international news network Al Jazeera were among those infected through the weaponized ad placements, which operated silently without visible pop-ups or suspicious links.

– Global identity graph, data harvesting

Discover-Tech operated a specialized system called Controlium that converted routine commercial advertising auctions into an expansive surveillance apparatus. After analyzing 4 billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS in dozens of countries during a four-month period.

“Discover-Tech serves roughly 10 million ad impressions a day, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first-party cookies,” said Confiant.

Investigators found that the ads routinely collected user session cookies, authenticated login tokens, and personal identifiers directly from publisher websites, exfiltrating the data even when European Union privacy regulations strictly barred processing without consent.

Citizen Lab also revealed that an affiliated threat actor, dubbed Dark Cartographer, utilized Discover-Tech’s infrastructure to exploit vulnerabilities across mobile telecom providers, matching digital advertising identities to physical phone numbers to deanonymize mobile subscribers en masse.

– Focus on Palestine, sensitive targets

Geographic telemetry revealed sharp traffic spikes pointing to deliberate intelligence operations rather than ordinary commercial advertising campaigns.

Palestine emerged as the most heavily targeted territory, where Discover-Tech served nearly 2% of all digital advertisements in the territory, peaking at roughly 10% on April 7, with one in every 36 Android ads originating from the firm.

Surveillance traffic also landed directly on sensitive administrative and institutional networks, including the Armenian Prime Minister’s Office, international bodies, judicial agencies, universities and defense organizations.

Investigators detected surgical handoffs to Candiru servers in nine countries, with Belgium accounting for 56% of observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain, and others.

After the joint investigation was disclosed, Google, the European advertising association IAB Europe, Beeswax, Vungle, and Eskimi severed Discover-Tech’s access to their digital advertising systems.