Discover-Tech told the world it had "unrestricted access to top-ranking apps with 1+ billion daily active users." That was the one true line on its website.

From 2020 to 2026, the Tel Aviv company sat on Google's lists of certified Ad Manager vendors, ad technology partners and ads personalization providers, and on IAB Europe's approved vendor list for its GDPR consent framework. It ran a DSP. It bid on ads. It looked like a thousand other Israeli ad tech shops.

On Thursday, the University of Toronto's Citizen Lab and the ad security firm Confiant published coordinated reports saying Discover-Tech was something else: a pipeline that let mercenary spyware vendors pick a target by ad ID and infect the device the moment an ad rendered. No click. No download. Just an ad you might never have noticed.

Citizen Lab says the technique, which it named AdFection, was used to hit at least 45 devices at Al Jazeera in 2024 and 2025 with spyware from Candiru, the Israeli firm the U.S. blacklisted in 2021. It calls this the first public technical confirmation of zero-click spyware delivered through targeted ads.

The ads came through Google. Through Yandex. Through Comcast's Beeswax. The industry's own certification badges were the cover.

John Scott-Railton of Citizen Lab put the whole story in four words on X. How does a spyware operation live inside advertising for six years? "It gets certified."

The checking wasn't hard. Citizen Lab says Israeli company records showed Eric Banoun joining Discover-Tech's board weeks after it was founded in March 2020 and staying until January 2025. Banoun co-founded Circles, a close NSO Group affiliate, and Senpai Technologies, part of the Intellexa consortium. From 2020 to March 2026, Discover-Tech's shareholders included Chaia Services Ltd, a British Virgin Islands company that Haaretz reported had Sara Hamou as a director. Hamou managed Intellexa's corporate network and was sentenced to eight years in prison by a Greek court, pending appeal, over the Predatorgate spyware scandal.

That was in the corporate filings the whole time. Google certified the company anyway. IAB Europe approved it anyway.

Both have now pulled the badges. Google says it worked with the researchers and blocked Discover-Tech "for systematically violating our policies." IAB Europe told Reuters it suspended the company after an audit found policy violations.

Six years of certification. One week of audit.

Here is how it worked, per Citizen Lab. Discover-Tech wins an auction. Its ad loads on your app or web page. Inside the ad is a script that calls home to a Discover-Tech server and hands over your mobile ad ID or cookie ID and your IP address. If you are not on a customer's list, the server sends back nothing at all, a zero-byte response. If you are, it sends code.

That design is the genius and the crime. The exchanges serving the ad never see the payload. Neither does anyone scanning the creative. The malicious part only exists for the one person it was built for.

Discover-Tech's control panel, called Controlium, let customers target users by iOS or Android ad ID, by Beeswax or MyDSP cookie ID, or by IP address. Citizen Lab got a look because Discover-Tech shipped the panel's entire front-end source code on its own login page. One locked endpoint greeted visitors with "ONLY DEKEL IS ALLOWED!!!", a likely nod to CEO Dekel Boni.

Al Jazeera handed over its network logs. Citizen Lab says they show the same sequence on infected machines: a Discover-Tech ad impression, then a Candiru validator server, then a Candiru command and control server. Al Jazeera isolated a Windows spyware file from one device, and Citizen Lab matched it with high confidence to Candiru's known tooling. The network said it "condemns the targeting of devices belonging to several of its employees with spyware."

Al Jazeera wasn't the only name in the logs. One Candiru infection link posted to VirusTotal decrypted to an IP address registered to the Saudi Ministry of Foreign Affairs.

And Candiru isn't really Israeli anymore. Its assets were bought in 2025 by Integrity Partners, a U.S. investment firm, in a deal reported at up to $30 million, and the business now runs as Integrity Labs. Neither Integrity Labs nor Integrity Partners responded to Citizen Lab or Bloomberg.

Discover-Tech bought through its own platform, MyDSP, and separately through Comcast's Beeswax and the DSP Eskimi. Citizen Lab got MyDSP's bidding data because Discover-Tech left nearly four billion bid records sitting on a world-readable server. Here is where MyDSP's bids went from March to June 2026:

Ads carrying the attacker script ran on 120,768 websites and 75,373 apps. The site list reads like a media buyer's dream plan: Yahoo, AccuWeather, Tripadvisor, Weather.com at around 400,000 ads, and a long tail that included The New York Times, Fox News, the BBC, CBC and Haaretz. In apps, MX Player, Viber, Truecaller, Duolingo, Yahoo Mail and Grindr.

Then there's NBC News, which broke the U.S. version of this story on Thursday. Citizen Lab documented a Discover-Tech ad served on nbcnews.com in August 2025, bought through MyDSP and Google. NBC News is owned by Comcast. So is Beeswax, which ran Discover-Tech's buys and synced cookie IDs with it. Comcast says Beeswax removed Discover-Tech "following recent activity."

Recent activity. Six years of it.

Keep reading free with your email: the logged-in sessions Discover-Tech lifted from more than 1,000 publishers, the targeting map that put Palestine first, a DSP that spent $109,091 and booked zero revenue, and the ad tech names nobody has asked yet.