- Citizen Lab says Israel-based Discover-Tech used ad auctions to deliver Candiru spyware to chosen devices, including at least 45 at Al Jazeera, with no click needed.
- Most viewers were sent no code, but Citizen Lab assesses that impressions of ads carrying the tracking script would, at minimum, have resulted in profiling.
- Ask your team whether staff devices block ads and trackers, and whether network logs can show a visit to an ad domain followed by an odd server.
A clean ad can still be a delivery route
Most security checks on online ads ask what the ad contains. A new report suggests that is not enough. What an ad does can be decided at the moment one person sees it. The lesson here is simple. If code can differ for each viewer, inspecting it once says little.
What Citizen Lab found
Citizen Lab, a research group at the University of Toronto, published a report called AdFection. Its researchers conclude that Israel-based Discover-Tech, though it presents as an ad business, appears to exist mainly to link spyware sellers to the ad industry. They say earlier work had not shown, in technical detail, spyware reaching victims through targeted ads.
Their clearest case is Al Jazeera. In 2024 and 2025, they say, at least 45 devices inside the network were targeted. They link these attacks, with high confidence, to Candiru spyware delivered through Discover-Tech's ads.
How an ad becomes an attack route
Most ads you see are the result of an auction. In under a second, your device sends a bid request. Bidders learn about the device, including its IP address and advertising ID. The winner's ad appears. That ad can carry code as well as a picture.
Citizen Lab says a large number of Discover-Tech's ads held a script tag. When the ad loaded, it contacted a Discover-Tech machine the company calls a "NOAS server". It passed along the viewer's identifiers. The server then decided, apparently from the IP address and identifiers, whether to send code back.
For most viewers, the answer was an empty reply. For a chosen target, code came back. That code could load more code, including a browser exploit that installs spyware.
This design matters. The researchers say it let Discover-Tech avoid handing harmful code, or even links to it, to the firms that deliver ads. Those firms had little to find.
An empty reply did not mean no harm
Receiving no code is not the same as being untouched. Citizen Lab says an ad carrying the script still gathered data from the viewer's browser. That included cookies from the page and the device's public IPv6 address. It sent this back to Discover-Tech.
iTnews reports that Citizen Lab put it this way: "At minimum, we assess that these ad impressions would have resulted in profiling by Discover-Tech." The report also describes mass profiling and unmasking of users as part of the company's purpose.
So there were two risks. Chosen targets faced infection. For other viewers of ads carrying the script, Citizen Lab assesses that profiling was the minimum outcome.
How customers picked targets
Citizen Lab describes a control panel called Controlium. Customers could pick a person by advertising ID, cookie ID or IP address. They could also limit campaigns to certain countries.
In the Al Jazeera network logs, infected devices first contacted Discover-Tech domains. Next they contacted a Candiru validator server, which checks a device before infection. Last, they contacted a command-and-control server.
Six years on trusted lists
Citizen Lab says Discover-Tech appeared on lists of certified and approved ad vendors. Google and the trade body IAB Europe kept them. The company stayed listed from 2020 until 2026. The researchers say this helped it look legitimate.
After the investigation, both removed it in early October 2026. Google, which helped the investigation, ended the firm's access to its ad exchanges. Beeswax removed it. Vungle (Liftoff) paused its access. Eskimi blocked its accounts and domains.
The sources do not say how those lists are checked. Our view is narrower. A vendor's listing tells you who the vendor is said to be. It does not show what each ad does when it loads.
What it means for Australia
iTnews reports that the researchers saw many ad impressions in Australia. They landed on government, power-sector, university and research networks. The report names the Australian Nuclear Science and Technology Organisation (ANSTO) and the Australian Synchrotron, which it operates. Three Australian media organisations, unnamed, were also reached.
The limits matter. Citizen Lab stresses that seeing an ad on a network does not prove anyone there was a target or was infected. Confiant, a New York ad security firm that published its own report, found nine countries where devices were passed to Candiru. Australia was not one of them. Confiant also says the Candiru-linked ads were a tiny share of Discover-Tech's activity.
ANSTO told iTnews it had found no impact on its facilities, systems or information. It left open whether ads are blocked on staff devices or its network.
Questions for your security team
First, do we block ads and third-party trackers on staff devices and networks? Know the answer before anyone asks.
Second, can our network logs show the pattern seen at Al Jazeera? That is an ad domain, then an unfamiliar server, then a command server. If logs are kept, can someone look back through them?
Third, how fast do we patch browsers and operating systems? The report describes ad code that can load a browser exploit. Current software is a sensible first defence. That is our view, not a finding of the report.
Fourth, which of our people would interest a buyer of spyware? Their devices deserve stricter controls than the rest.
An ad is code that someone else decides to run on your screen. Treat it that way.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Citizen Lab, University of Toronto.
