An Israeli advertising technology firm, Discover-Tech, used ordinary online advertisements to track people and install spyware on their devices, according to Reuters reporting published on October 15, 2026. The company placed its ads across a vast network of websites and applications through advertising platforms operated by Google, Comcast and Yandex.

Independent investigations by Citizen Lab and Confiant detailed how the operation worked: simply loading an advertisement could expose users to surveillance or spyware, even without a click.

How a loaded ad was enough to compromise a device

Real-time bidding, the system that auctions ad space in milliseconds, shares device and location data with potential buyers, and some advertisements also run code. That combination of shared data and executable ad code is what the researchers identified as the opening for the technique. Citizen Lab has named the zero-click spyware technique "AdFection" and links Discover-Tech to Candiru, an Israeli spyware maker blacklisted by the United States in 2021.

On April 12, 2026, Confiant identified a MyIPInfo banner that redirected to infrastructure linked to Candiru through Amazon CloudFront. The ad loaded a fake verification tool containing roughly 90KB of hidden JavaScript, allowing it to collect information about the device and communicate over an encrypted channel. Confiant investigated the activity between April and September 2026.

45 infected machines at Al Jazeera, millions more exposed

Citizen Lab examined four billion bidding records and found that Discover-Tech had booked its advertisements on at least 120,000 websites and in 75,000 applications. Confiant estimates that at least 10 million advertisements were delivered via Discover-Tech every day. Confiant co-founder Jerome Dangu said "very likely hundreds of millions of people would have been touched by Discover-Tech."

Citizen Lab confirmed that Candiru spyware compromised 45 Windows machines at Al Jazeera during 2024–2025. The broadcaster said it "condemns the spyware attacks targeting a number of its staff."

Discover-Tech ads also appeared networks associated with government and international agencies, including the Pentagon, the United Nations, NATO, the European Commission, the International Atomic Energy Agency and the International Criminal Court. Researchers also detected the ads on networks linked to chipmakers Nvidia, Broadcom and Micron.

Exposure does not necessarily mean infection, however. Unlike the reported compromises at Al Jazeera, these appearances do not establish that spyware successfully infected devices at those institutions.

Google, IAB Europe and Beeswax cut off access

Google removed Discover-Tech from its advertising platform "for systematically violating our policies." IAB Europe dropped the company from its list of approved vendors, and Comcast's Beeswax blocked its access to the platform.

The findings have raised broader concerns about online advertising security. Citizen Lab researcher Wolfie Christl warned that "the way online advertising works today is a systemic security threat."

A $1.34 trillion market built on the same infrastructure

The advertising market continues to grow, raising the stakes for security. Real-time bidding sits at the heart of that ecosystem: the same auctions that allocate billions in spending also decide which advertisements — and the code they carry — reach users' devices. WARC expects global ad spending to reach $1.34 trillion in 2026, while programmatic advertising in the United States generated $162.4 billion in 2025, according to IAB figures. Security measures have been unable to keep pace with the advertising industry's increasing application of artificial intelligence.

IAB research shows that only about 40% of surveyed ad buyers have already taken, or plan to take, action on the legal, security and data risks related to AI-powered measurement.

Norway recently fined Microsoft-owned Xandr NOK 92 million for unlawfully sharing sensitive Grindr data through ad auctions — a privacy violation rather than a spyware case. regulator Line Coll said responsibility "cannot be passed on to others."

The Discover-Tech case comes as advertising companies increasingly invest in consumer data and AI-powered targeting. As Cryptopolitan previously reported, Publicis Groupe signed an agreement to buy LiveRamp for $2.2 billion, strengthening its AI-based marketing activities. While that deal has no connection to the spyware attacks, it underscores how central data and automation have become to the industry.

Citizen Lab has called for investigations into Discover-Tech and Candiru, putting pressure on advertising platforms to improve how they screen vendors and detect malicious advertisements. Whether those calls produce formal investigations — and tighter vendor screening across the ad tech supply chain — remains to be seen.