The University of Toronto’s digital research lab has released a report that changes the focus of the debate on targeted surveillance. Second Citizen Labat least 45 devices attributable to the satellite broadcaster Al Jazeera were compromised between 2024 and 2025 by spyware attributed to Candiru, delivered via ordinary advertisements, without the victims clicking on anything or opening suspicious files.
The mechanism identified by the researchers revolves around Discover-Techan Israeli company founded in March 2020 that presents itself as a digital advertising agency but which, according to the report, has never carried out any verifiable legitimate advertising activity. Discover-Tech manages Controliuma platform that allows its customers to profile and deanonymize millions of internet users through the device’s advertising identifier, browser cookies or IP address, and then selectively target targets with malicious code delivered by an apparently harmless ad.
The operation described by Bill Marczak, a researcher at Citizen Lab, is as linear as it is disturbing: when a Discover-Tech ad is loaded on the device, it contacts a server that decides in real time whether to return malicious JavaScript based on the advertising identifier and IP detected. If the device is in the target list, the infection starts automatically, in a few seconds and without any user interaction.
A supply chain that passes through Yandex and Google Ad Manager
The analysis of almost 4 billion advertising bid requests collected between March and June 2026 shows the scale of the phenomenon: Discover-Tech ads passed on 120,768 websites And 75,373 apps for Android and iOS, reaching bids coming from 161 countries. The highest volumes come from Yemen, Pakistan, Montenegro, Brazil and Mexico, but network impressions have also been detected on government network infrastructures of NATO, the United Nations and defense ministries of several Nordic countries.
Forensically, the recovered spyware sample shares with the well-known Candiru an attack chain already observed in 2021: persistence via hijacking of Windows COM components, a 48-byte XOR encryption with a characteristic “dummy” null terminator and hardcoded connectivity checks to domains such as Google and Microsoft. Elements which, according to Citizen Lab, point with “high confidence” to an updated version of the surveillance company’s arsenal, now operating under the Integrity Labs brand.
After the publication of the report, Google revoked Discover-Tech’s certified supplier status and IAB Europe removed it from its register; Beeswax and Vungle have also suspended access to their respective buying platforms. However, the underlying issue remains: the adtech ecosystem, built to profile and target the advertising public with surgical precision, offers exactly the same capabilities to those who want to weaponize it against individuals, without the user having any way of realizing it.
