Every time your phone loads a webpage with ads, a real-time auction fires — hundreds of billions per day — broadcasting your device ID, location, and IP address to dozens of bidders in under a second. Citizen Lab has now documented, with technical proof, that an Israeli company called Discover-Tech exploited this architecture to deliver Candiru mercenary spyware to devices at Al Jazeera without any user interaction. The ad rendering itself was the infection vector. They call it AdFection, and it is the first publicly confirmed case of zero-click spyware delivered via programmatic advertising. Discover-Tech operates a platform called Controlium that sits between the ad ecosystem and mercenary spyware vendors. When a targeted ad wins a bid and renders on a victim's device, a script tag fires back to Discover-Tech's "NOAS server," submitting the user's advertising identifiers and executing arbitrary JavaScript in return. That JavaScript chain can fingerprint the device, de-anonymize the user, and deliver a browser exploit — all before the ad finishes loading. The target never clicks anything. The ad system does the work. The scale is staggering. Analysis of four billion Discover-Tech bidding records over just four months shows ads served on nearly 200,000 unique websites and apps across dozens of countries. Millions of devices were covertly redirected to contact Candiru's servers, likely for mass tracking and reconnaissance far beyond the specific spyware infections. A separate threat actor Citizen Lab calls DARK CARTOGRAPHER used Discover-Tech's infrastructure to exploit vulnerabilities across mobile carriers, linking device advertising IDs to phone numbers — mass de-anonymization of internet users at carrier level. Discover-Tech is not a rogue outsider. It appeared on Google's and IAB Europe's lists of certified and approved vendors. It bought ads through Google, Yandex, Beeswax (Comcast-owned), Vungle, and others. It leveraged GDPR consent frameworks to target EU users. Its corporate links run deep into Israeli offensive cyber: board member Eric Banoun is described as a pioneer of offensive cyber in Israel; a shareholder company was linked to Sara Hamou, who managed the corporate network of the Intellexa spyware group. Connections extend to mercenary firms Bindecy and ADINT vendor Intelos. The structural lesson is damning. The RTB system was not hacked — it was used as designed. The architecture that enables advertisers to target individuals by device ID, run arbitrary code on their devices, and do so at millisecond speed with no human review is not a bug. It is a feature that the surveillance industry recognized as a weapons delivery system. Discover-Tech simply built the bridge. The advertising ecosystem's own data collection and code-execution capabilities are the vulnerability. Google, IAB Europe, Beeswax, Vungle, and Eskimi disconnected Discover-Tech after Citizen Lab's disclosure. Other ad vendors involved did not respond. But the fix addresses one company, not the architecture. Any sufficiently motivated actor with a DSP account can replicate this approach — the auction system broadcasts targeting data to all bidders, the code-execution permission is baked into ad rendering, and the speed of RTB makes real-time review effectively impossible. Citizen Lab calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws. The deeper question is whether an advertising system that auctions the right to run code on individual devices hundreds of billions of times daily can ever be made safe from state-grade exploitation. The answer, based on this evidence, is that the system's core design is the exploit.
