The online advertising ecosystem — the real-time bidding infrastructure that serves billions of ads per day — has been confirmed as a functional weapons-delivery system. A joint investigation by Citizen Lab and Al Jazeera reveals that Israeli spyware firm Candiru, already blacklisted by the US government in 2021, exploited programmatic ad auctions to deliver zero-click malware to 45 devices used by Al Jazeera journalists in June 2025. The intermediary was Discover-Tech, an Israeli company posing as a legitimate advertising firm while operating as a front for mercenary spyware deployment. The mechanism is elegant and terrifying. When a user loads a webpage or app, an automated auction sells the ad slot in milliseconds. That auction broadcasts the target's device ID, IP address, rough location, and the app or site they are using. Discover-Tech participated in these auctions as a certified vendor — appearing on approved lists maintained by Google and IAB Europe — and used the leaked bidstream data to identify specific individuals. Once it won the auction for a target's screen, the ad itself delivered malicious code that exploited browser vulnerabilities to install Candiru's spyware without any user interaction. The spyware's capabilities are comprehensive: file and document exfiltration, browser data including cookies and saved credentials, keystroke logging, screenshot capture, microphone and webcam recording, and extraction of emails and messages from communication platforms. To evade detection, the malware uses encrypted channels and fragments stolen data into small chunks transmitted over time. Cybersecurity analyst Eddy Willems notes the attack chains multiple vulnerabilities — first breaching the browser, then escaping its sandbox to gain full device control. The reach extends far beyond journalists. Citizen Lab found Discover-Tech advertisements appearing on devices within networks belonging to the Pentagon, United Nations, NATO, the European Parliament, the European Commission, the International Atomic Energy Agency, and the International Criminal Court. Government networks in at least 24 countries were targeted, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico, and Israel itself. Advertising security firm Confiant independently corroborated these findings. While infection has not been confirmed in all cases, the profiling alone — mapping who is on what network, using what device — constitutes a significant intelligence operation. The structural failure is in the ad-tech system itself. Real-time bidding was designed to spray personal data to thousands of unknown bidders in every auction, optimized for ad targeting with zero security consideration. Discover-Tech exploited this by design, not by hacking it. Google and IAB Europe's certification processes failed to detect a front company for a US-blacklisted spyware vendor. As TU Dublin lecturer Stephen O'Shaughnessy puts it: the ad system was built to send code from strangers to billions of screens with pinpoint targeting, and almost nobody was watching it from a security angle. For ordinary users, the immediate risk remains low — these are expensive, targeted operations. But the structural vulnerability is universal. Anyone whose device displays programmatic ads is theoretically reachable. The recommended defenses — ad blockers, disabling advertising IDs, enabling Lockdown Mode or Android's Advanced Protection, keeping software updated — shift the burden entirely onto individual users. The systemic fix requires the ad industry to vet buyers and regulators to restrict the personal data broadcast in every auction, neither of which has materialized. The twenty-year implication is clear: if the ad-tech bidstream remains an open intelligence pipeline, nation-states and mercenary firms will industrialize this vector. The cost per target will drop. The certification systems will remain porous. And the distinction between commercial surveillance and state-sponsored espionage will become functionally meaningless.
