The Israeli advertising agency Discover-Tech used an advertising infrastructure through which spyware developers could infect devices without clicks on adverts. The Kazakhstani website Vesti.kz was also among the resources on which advertising linked to this infrastructure was displayed.
HOW THE SPYWARE DISTRIBUTION SCHEME WORKED
According to research by Citizen Lab at the University of Toronto and the company Confiant, which specialises in digital advertising security, Discover-Tech provided advertising services to spyware developers. Through the Controlium platform, clients could select an audience for displaying adverts.
The technical scheme allowed advertising code to launch a chain of JavaScript scripts. At one of the stages, special programs could be launched that exploit software flaws in order to gain access to a device and install spyware. Therefore, infection could occur without following a link and even without clicking on an advert. Researchers call this type of attack AdFection.
WHICH ORGANISATIONS WERE AMONG THE TARGETS
In 2024–2025, such attacks affected the Al Jazeera news network. Researchers discovered at least 45 devices on which contacts with domains of the Discover-Tech infrastructure were recorded, followed by connections to a server belonging to the spyware developer Candiru, also known as Integrity Labs.
Researchers also described the activity of an attacker designated as DARK CARTOGRAPHER. He used mobile operator vulnerabilities to link advertising identifiers with telephone numbers and establish users' identities.
Among the organisations that were shown advertising linked to this infrastructure, researchers named the Pentagon, the International Atomic Energy Agency (IAEA) and the International Criminal Court. Such adverts also appeared on the networks of the UN, NATO and the European Commission.
WHICH SITES DISPLAYED THE ADVERTS
The list of resources on which such advertising was found included the Viber messenger, the Yahoo Mail email service, the dating apps Badoo and Grindr, as well as media sites, including the British BBC, the American The New York Times, the Serbian Kurir, the Montenegrin Vjesti and the Kazakhstani Vesti.kz.
At the same time, the very fact that Discover-Tech advertising was displayed does not prove that a specific user was subjected to a targeted attack or that their device was infected with spyware. According to the study's assessment, adverts linked to Candiru made up only a small part of the total volume of advertising.
WHAT MEASURES THE ADVERTISING PLATFORMS TOOK
Previously, Discover-Tech was among the certified personalised advertising providers recognised by Google and the advertising industry association IAB Europe. However, both organisations subsequently removed the company from among their advertising partners.
Confiant co-founder Jerome Dangu estimated the potential reach of Discover-Tech advertising at “hundreds of millions” of people worldwide.
