Dossier mode
The Advertising Weapon
The same investigation, restaged one beat at a time. Drive it with the arrow keys, space, or autoplay. Nothing is cut from the piece — long runs are split across frames. Read the full investigation or open the Israeli Influence on the United States hub.
The Advertising Weapon.
You didn't have to click. The ad only had to load. That was enough for an Israeli ad firm to identify your device, profile you, and — for the targets that mattered — help plant spyware.
Citizen Lab and Confiant found that the Israeli ad agency Discover-Tech weaponized the ordinary online-advertising system into a zero-click surveillance-and-spyware pipeline — handing US-blacklisted Candiru and other Israeli firms a route into Google, Comcast, and Yandex ad networks.
The documented findings graded FACT; the stronger 'knowingly ran a spy operation' graded PROBABLY TRUE — strongly evidenced, no court ruling, and the firm answered nothing.
The finding: 'AdFection.'
On Oct 15, 2026, the University of Toronto's Citizen Lab (report titled 'AdFection') and the NY ad-security firm Confiant published a joint investigation, reported by Reuters, concluding that Discover-Tech — an Israeli digital advertising agency founded in 2020 — ran a covert surveillance and spyware-delivery operation through the normal online-ad system.
How it worked: zero-click, by ad-load.
Discover-Tech served ~10 million ads a day across 120,000+ websites and 75,000 apps. No click needed — when an ad loaded, it could identify and track the device, profile the user en masse, follow them via 'cookie matching,' sometimes extract a phone number, and select particular devices for more intrusive operations.
The pipeline: a door back in for blacklisted spyware.
Discover-Tech's platforms gave Candiru — an Israeli spyware maker the US blacklisted in 2021 for selling malware used against officials, journalists, and activists — and other Israeli surveillance firms access to the major ad networks run by Google, Comcast (Beeswax), and Russia's Yandex. A vendor platforms were meant to keep out was handed a route back in via an ad middleman.
The proof: 45 devices at Al Jazeera.
Citizen Lab confirmed that a powerful form of Candiru spyware, delivered through Discover-Tech's ads, compromised 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025. Al Jazeera shared network logs, which is how the delivery path was traced — a documented, attributed compromise, not just theory.
Who it reached, and who went silent.
The malicious ads turned up on networks in sensitive categories — the Pentagon, the IAEA, the ICC — and saturated the Palestinian territories (reach/exposure, not proof every device was hacked). When flagged, Google removed Discover-Tech 'for systematically violating our policies,' IAB Europe suspended it, and Comcast's Beeswax removed it; Yandex didn't respond. Discover-Tech and its CEO Dekel Boni answered nothing, and Candiru's owners were unreachable — we carry that silence in place of a denial.
How this page is graded.
- FACT: the Citizen Lab/Confiant findings — the ~10M-ads/day network across 120k+ sites and 75k apps; the zero-click profiling/tracking; the Candiru (and other Israeli firms') access to Google/Comcast/Yandex ad platforms; the Citizen-Lab-confirmed 45-device Al Jazeera compromise (2024-25); the presence in Pentagon/IAEA/ICC networks; and the platform removals.
- PROBABLY TRUE: that Discover-Tech knowingly built and ran this as a spy operation — the researchers' strongly evidenced conclusion, but not adjudicated, and the company answered nothing.
- FENCE: the Candiru-linked ads were a tiny fraction of a vast, legit-looking business (the cover); the ad platforms were abused, not shown to be complicit; presence in a network is exposure, not proof every device was hacked. Named actors are Israeli, in a documented surveillance-export pattern — not nationality for its own sake.
Why it matters.
Commercial spyware used to mean exotic attacks — a booby-trapped text, a zero-day sold for millions. AdFection needed none of that: the delivery system was the thing already on every website and in every free app, the ad network that exists to identify and follow you. A firm that could plug spyware into it didn't have to trick you — it only had to buy an ad. It's the convergence of the normal surveillance economy and a specific Israeli surveillance-export industry, finding one more layer of ordinary infrastructure to hide inside — of a piece with Paragon and the Barak/Carbyne pipeline.
Help us fill these lines.
- OpenThe full Citizen Lab 'AdFection' technical report and the complete list of spyware partners beyond Candiru.
- OpenWhether any government client of Candiru/Discover-Tech can be named, and who was targeted beyond Al Jazeera.
- OpenAny legal or regulatory action (US, EU) that follows the platform removals, and whether Discover-Tech or Candiru ever respond on the record.