Ad exchanges cut off an Israeli vendor after researchers trace spyware through real-time bidding

Citizen Lab published Report No. 195 on 15 October, alongside a parallel investigation by the New York ad-security firm Confiant, describing how Discover-Tech — an Israeli digital advertising agency registered in 2020 — ran a platform called Controlium that let mercenary spyware clients reach named devices through the real-time ad bidding system. The report, authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, says at least 45 devices at Al Jazeera Media Network were targeted in 2024 and 2025 in zero-click attacks linked “with high confidence” to Candiru spyware, now operating as Integrity Labs and on the US Commerce Department Entity List since November 2021. The evidence base is network logs Al Jazeera handed to researchers after its own internal investigation, running from Discover-Tech infrastructure to Candiru validation servers to spyware command-and-control.

The scale figures belong to the plumbing, not the victims. Between March and June 2026 the operation placed 3.77 billion ad bids and won 442 million auctions; ads assessed to carry attacker script tags appeared on 120,768 websites and in 75,373 mobile apps. Citizen Lab states explicitly that these are not infection counts, a distinction several outlets have already blurred. Confiant’s Jerome Dangu told Reuters that “very likely hundreds of millions of people would have been touched by Discover-Tech,” and that in the Palestinian territories saturation was near-total: “You go to almost any site in Palestine — any site — you find a Discover-Tech ad.” Google cut the firm’s exchange access in early October for “systematically violating our policies”; IAB Europe suspended it from its Global Vendor List on 8 October after an audit; Beeswax, Comcast’s ad-tech subsidiary, removed it from its platform.

Al Jazeera said on 15 October that it “condemns the spyware attacks targeting a number of its staff” and that cooperation with Citizen Lab “helped verify and publicly document these attacks.” Discover-Tech, contacted by Reuters through its website form, did not reply. No response from Candiru/Integrity Labs or from any Israeli government body has been located in the coverage reviewed here. Citizen Lab also names two linked entities — Bindecy, in mercenary hacking, and Intelos, in ad intelligence — and an umbrella operation it calls DARK CARTOGRAPHER, traced to 2019, which the researchers say involves an unnamed US intelligence contractor. That contractor is not identified in the public report and should be read as a loose end rather than a finding.

Assessment: The disclosure is a day old; the governance consequence is the news. Discover-Tech sat on Google’s certified vendor lists and IAB Europe’s Global Vendor List since 2020, which means the audit regime that is supposed to police ad-tech supply chains certified a spyware delivery path for six years and only caught it when outside researchers handed over victim logs. Expect the industry to frame this as a bad actor expelled rather than a structural hole, which is the opposite of what Christl argued when he called online advertising “a systemic security threat.” Note also what the report does not establish: the vendor and the delivery chain are documented, the customer is not. Who paid for 45 Al Jazeera devices is the open question, and several plausible buyers are Gulf states, not Israel.