Ad Networks Turned Into Spyware Delivery Systems
Surveillance control · 16.10.2026

Regular targeted ads can now infect your phone without a single click. Just show the banner — and that's it. Citizen Lab discovered the AdFection technique and proved: ad networks have turned into spyware delivery pipelines.

The victim — the international TV network Al Jazeera. Between 2024 and 2025, at least 45 devices inside the newsroom were infected. The spyware — a Candiru product (rebranded as "Integrity Labs"). The chain is simple: a device receives an ad from the Israeli company Discover-Tech, which routes the victim through a Candiru verification server, and eventually the malware calls home to a command server. Everything was confirmed through network logs with a precise timeline.

Discover-Tech, meanwhile, had been listed for years as a "certified" vendor by Google and the industry association IAB Europe. In other words, the ad industry itself vetted and stamped a seal of approval on a system that was distributing spyware through advertising. Only in October 2026, after the investigation, did Google and IAB Europe finally remove the company from their lists.

This isn't an isolated case. Analysis of four billion bidding records over four months showed that Discover-Tech's ads appeared on nearly 200,000 unique websites and apps across dozens of countries. Their platform, Controlium, allowed users to be de-anonymized and infected with literally a mouse click in a control panel — select a device ID, and go.

The company is linked not only to Candiru but also to other players in the spyware market — Bindecy and the ADINT firm Intelos. Among Discover-Tech's shareholders at various points was an entity connected to a person who managed Intellexa's corporate network.

Another actor surfaced separately — DARK CARTOGRAPHER, which exploits vulnerabilities at telecom operators through Discover-Tech's infrastructure to mass-match advertising IDs with phone numbers. Citizen Lab promises a separate report on this one.

The takeaway is simple: online advertising isn't just a banner with cute cats — it's an entire system for passing your data on to anyone. And while regulators hand out "trustworthy" certifications, someone is quietly installing spyware through those very certifications.

Source: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/