An investigative report from Citizen Lab, cited in the Pluralistic post, reveals that an Israeli company calling itself Discover‑Tech operated as a delivery system for mercenary spyware. The firm masqueraded as an ordinary ad‑tech vendor but used the programmatic advertising infrastructure of Google, Facebook, Yandex, Microsoft, Beeswax (a Comcast division) and others to locate specific internet users and serve them malicious ads containing “zero‑click, zero‑day” exploits. These exploits could compromise a device simply by loading a web page or opening an app that relied on the compromised ad network, requiring no interaction from the victim.
The report says Discover‑Tech was certified as a safe supplier by Google, Yandex, Microsoft, Beeswax and the Interactive Advertising Bureau (IAB). That certification gave it access to more than four billion ad auctions, allowing it to check the identities of users loading apps or visiting websites against target lists and launch attacks on any matches. Among the observed targets were employees of Al Jazeera, who were hit with malware from the spyware vendor Candiru (now rebranded as Integrity Labs). Beyond Candiru, Discover‑Tech facilitated attacks for numerous other criminal mercenary spyware firms, serving malicious ads on hundreds of thousands of sites and apps.
Discover‑Tech’s ties extend to other Israeli offensive‑cyber companies. Its board included Eric Banoun, described by Haaretz as “one of the pioneers of offensive cyber in Israel,” and the firm shares overlaps and affiliations with notorious actors such as the NSO Group, whose cyber‑weapons have been used against journalists, activists and embassy workers worldwide.
The Citizen Lab authors argue that the episode exposes the fundamental insecurity of the ad‑tech ecosystem, which amasses pervasive surveillance data yet fails to vet advertisers adequately. They note that the only reliable defense for end users is to block ads, a practice already adopted by more than half of internet users. However, blocking ads inside mobile apps remains legally fraught in many jurisdictions due to anti‑circumvention rules, and many sites deploy anti‑ad‑block scripts that guilt‑trip users or demand payment for access.
While the post acknowledges that advertising itself is not the problem, it stresses that surveillance‑based targeting—driven by the desire for marginally higher click‑through rates—creates a dangerous pipeline for state‑aligned and criminal hackers. The authors conclude that banning surveillance advertising and restoring context‑based ads would remove the incentives that allow ad‑tech networks to be hijacked by mercenary spyware operators.
Key facts
- Discover‑Tech is an Israeli ad‑tech company that served as a conduit for mercenary spyware.
- It used Google, Facebook, Yandex, Microsoft, Beeswax and other ad platforms to deliver zero‑click malware.
- The company was certified by Google, Yandex, Microsoft, Beeswax and the IAB, granting access to over four billion ad auctions.
- Targets included Al Jazeera workers and were hit with malware from Candiru/Integrity Labs.
- Discover‑Tech has links to NSO Group and other Israeli offensive‑cyber firms.
- Citizen Lab recommends ad blocking as the primary user‑level defense.