The Advertising Weapon
You did not have to click anything. The ad only had to load. That was enough for an Israeli advertising company to identify your device, profile you, and — for the targets that mattered — help plant spyware on your machine.
On October 15, 2026, the University of Toronto’s Citizen Lab and the ad-security firm Confiant published a joint investigation, reported by Reuters, into an Israeli firm called Discover-Tech. They found it had turned the ordinary machinery of online advertising into a surveillance and hacking pipeline — one that gave the US-blacklisted spyware maker Candiru, and other Israeli surveillance firms, access to the world’s biggest ad networks. We grade the documented findings as fact and the word “knowingly” with the care it deserves.
What this page is about
Every time you load a web page or open a free app, a split-second auction happens: advertisers bid to put an ad in front of you, and to win, they are handed a stream of data about your device. According to a joint report by Citizen Lab and Confiant — which the researchers titled “AdFection” and Reuters published on October 15, 2026 — an Israeli advertising agency founded in 2020, Discover-Tech, weaponized exactly that machinery. It ran a real, enormous ad business — serving at least 10 million ads a day across more than 120,000 websites and 75,000 apps — and used it as cover and as a weapon.
The key horror is that it was zero-click. A user did not have to tap anything; the ad merely had to load. From that, Discover-Tech could identify and track the device, profile the user en masse, sometimes extract a phone number, and — for selected high-value targets — help deliver spyware. Its platforms reportedly gave Candiru, an Israeli spyware firm the US blacklisted in 2021, and other Israeli surveillance vendors a way into the ad networks run by Google, Comcast, and Russia’s Yandex. Citizen Lab confirmed one concrete result: Candiru spyware delivered through Discover-Tech’s ads compromised 45 Windows devices at Al Jazeera, the Qatari broadcaster, between 2024 and 2025.
We grade the documented findings as fact: the ad network and its scale, the delivery mechanism, the Candiru link, the confirmed Al Jazeera compromise, and the fact that major platforms kicked Discover-Tech off once researchers flagged it. We fence the one thing a report like this cannot settle in a sentence: intent. The researchers describe a knowing spy operation, and the evidence is strong — but no court has ruled, and Discover-Tech did not answer a single question. We carry that silence, and we grade the “knowingly” as probably true rather than proven.
Books that go deeper on this story. Links are Amazon affiliate searches — buying through them supports the work at no cost to you.
The same investigation, restaged one beat at a time. Step through it here, or present it fullscreen.
The Advertising Weapon.
You didn't have to click. The ad only had to load. That was enough for an Israeli ad firm to identify your device, profile you, and — for the targets that mattered — help plant spyware.
The firm, the mechanism, the pipeline, and the proof
What was found, how the ads worked, who got access, the confirmed hack, who it hit, and how the platforms responded.
The finding: 'AdFection.'
FACTOn October 15, 2026, Citizen Lab (at the University of Toronto's Munk School) and the New York ad-security firm Confiant published a joint investigation — Citizen Lab called it 'AdFection' — reported by Reuters. It concluded that Discover-Tech, an Israeli digital advertising agency founded in 2020, had run a covert surveillance and spyware-delivery operation through the ordinary online-ad system. That the report exists and reaches this conclusion, from two credible research groups, is documented FACT.
How it worked: zero-click, by ad-load.
FACTThe mechanism is the story. Discover-Tech served at least 10 million ads a day across more than 120,000 websites and 75,000 apps. A user did not have to click; when one of its ads simply loaded, Discover-Tech could identify and track the device, build a profile, and — using data-sharing arrangements like 'cookie matching' — follow people beyond its own ad reach. For some smartphone users it could extract a phone number. The system let it profile users en masse and then select particular devices for more intrusive operations. Graded FACT per the researchers' technical findings.
The pipeline: a door into Google, Comcast, and Yandex for blacklisted spyware.
FACTDiscover-Tech's real significance was as a conduit. Its advertising platforms gave Candiru — an Israeli spyware company the US Commerce Department blacklisted in 2021 for selling malware used against officials, journalists, activists, and academics — and other Israeli surveillance firms access to the major advertising networks run by Google, Comcast (via its Beeswax platform), and Russia's Yandex. A spyware vendor that major platforms were supposed to keep out was, through an ad middleman, handed a route back in. Graded FACT.
The proof: 45 devices at Al Jazeera.
FACTThis is not only theory; there is a confirmed victim. Citizen Lab verified that a powerful form of Candiru spyware, delivered through Discover-Tech's ads, had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025. Al Jazeera shared network logs with the researchers, which is how the delivery path was traced. A documented, attributed compromise of a major news organization's devices via this ad pipeline — graded FACT.
Who it reached: the Pentagon, the IAEA, the ICC — and Palestine.
FACTThe ads turned up where they should alarm people most. Researchers found Discover-Tech's malicious ads appearing on networks in sensitive categories — including those of the Pentagon, the International Atomic Energy Agency, and the International Criminal Court — meaning devices inside some of the most security-conscious institutions in the world were exposed to the pipeline. And the saturation was especially dense in the Palestinian territories. The presence of the ads in these networks is documented FACT; it establishes reach and exposure, not that every such device was successfully hacked, a distinction we keep.
The response: platforms acted; the firm went silent.
FACTWhen researchers flagged Discover-Tech, the ad industry moved: Google removed it 'for systematically violating our policies'; IAB Europe suspended it; Comcast's Beeswax removed it; Yandex did not respond to inquiries. Discover-Tech itself answered nothing — it did not reply to messages left through its contact form, and its chief executive, Dekel Boni, did not respond to emails or LinkedIn messages; Candiru's owners were also unreachable. We carry that non-response in place of a denial: the accused parties were given the chance to answer the findings and declined. Graded FACT.
The surveillance was already in the plumbing
For years the story of commercial spyware was about exotic attacks — a booby-trapped text message, a hostile link, a zero-day sold for millions. “AdFection” is more unsettling because it needed none of that. The delivery system was the thing that is already on every website and inside every free app on earth: the online advertising network, which exists to identify you, follow you, and sell access to your attention. A firm that could plug spyware into that system did not have to trick you into anything; it only had to buy an ad. That is why this sits in both Surveillance States and Israeli Influence: it is the convergence of the two subjects this site watches most — the normal commercial surveillance economy, and a specific Israeli export industry that turns that economy into a weapon. It is of a piece with Paragon and the Barak/Carbyne pipeline: the same personnel and the same state-linked industry, finding one more layer of ordinary infrastructure to hide inside. We hold the fences — intent is unproven, the ad platforms were abused rather than complicit, the firm stayed silent — so the documented core lands plainly: the ads themselves became the spies.
Questions worth taking seriously
Could an ad really hack a device with no click?
Yes — that’s the documented finding, and it’s what makes this serious. Online ads carry code and are handed detailed device data to “target” you; that same channel can be used to identify a device, profile it, and select it for a spyware payload, all when the ad merely loads. Citizen Lab and Confiant traced exactly this, and confirmed one real result: Candiru spyware delivered via Discover-Tech’s ads compromised 45 Al Jazeera devices. The zero-click part is the point, not an exaggeration.
Are you saying Discover-Tech definitely ran a deliberate spy operation?
We grade the documented facts as fact — the network, the scale, the Candiru delivery, the Al Jazeera compromise, the platform removals. The stronger claim, that Discover-Tech knowingly built and ran this as a spy operation, is the researchers’ well-evidenced conclusion, and we grade it probably true rather than proven: there’s been no court ruling, and the company answered nothing when asked. We carry that silence rather than invent a denial for it.
Why frame this as an 'Israeli Influence' story rather than just a tech-abuse story?
Because the named firms are Israeli and they fit a documented pattern, not because of nationality for its own sake. Discover-Tech and Candiru are Israeli; Candiru was US-blacklisted in 2021; and this slots into a well-covered Israeli surveillance-export industry we track elsewhere (Paragon, the Barak/Carbyne pipeline, NSO’s lineage). We’re explicit that ad-tech abuse isn’t unique to Israel — but the specific actors here are Israeli surveillance firms, and that context is part of the story, honestly stated.
If you are named on this page
If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.
This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.
The record
- Reuters (via DAWN) — Israeli firm used online ads to run vast spy operation, researchers say
- CyberScoop — AdFection: how mercenary spyware invades devices through targeted advertising
- Security Affairs — AdFection: Citizen Lab exposes ad-delivered spyware networks
- Engadget — Citizen Lab details new spyware triggered by online advertising
- Calcalist — Israeli ad firm turned online advertising into a pipeline for spyware
- The Jerusalem Post — Israeli digital advertising agency used online ads to hack devices, spy on users
- U.S. News / Reuters — Israeli firm used online ads to run vast spy operation, researchers say