--- title: Citizen Lab: Israeli ad platform Discover-Tech used to... description: Citizen Lab researchers at the University of Toronto report that an Israeli ad-tech company, Discover-Tech, operated a platform called Controlium that let... canonical: https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Citizen Lab: Israeli ad platform Discover-Tech used to deliver zero-click spyware | daily.dev og:description: Citizen Lab researchers at the University of Toronto report that an Israeli ad-tech company, Discover-Tech, operated a platform called Controlium that let... og:url: https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw og:image: https://api.daily.dev/og/posts/kkyP5XnJW.png og:image:alt: Citizen Lab: Israeli ad platform Discover-Tech used to deliver zero-click spyware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Citizen Lab: Israeli ad platform Discover-Tech used to deliver zero-click spyware **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary Citizen Lab researchers at the University of Toronto report that an Israeli ad-tech company, Discover-Tech, operated a platform called Controlium that let clients profile and deanonymize internet users through ordinary online ads, then deliver zero-click spyware to selected targets. Government spyware vendors Candiru and Bindecy allegedly abused the platform, compromising at least 45 Windows devices at Al Jazeera in 2024-2025, with capabilities to exfiltrate messages, photos, emails, record calls and activate microphones. Leaked bidding data shows the ads reached millions globally, including networks tied to militaries, the UN, Nato, the ICC and the IAEA, though actual infection on those networks is unconfirmed. Researchers frame this as the first confirmed case of zero-click spyware delivered via ad networks and call for stronger regulation of the largely unmonitored programmatic advertising ecosystem. ## Content Citizen Lab researchers at the University of Toronto have documented what they call the first confirmed case of zero-click spyware delivered through ad networks. They named the campaign AdFection. A device could be infected the moment an ad rendered, with no click and no visible trace. ## How it worked The ads were brokered by Discover-Tech, an Israeli ad company that ran a platform called Controlium. Citizen Lab describes the company as a bridge between legitimate ad networks and the mercenary spyware ecosystem. Customers could pick targets by advertising ID, cookie ID, or IP address. The trick relies on real-time ad bidding. Most impressions Discover-Tech served returned no malicious payload at all. They only reported back the device's advertising ID and IP address. Exploit code went only to selected targets. That is also why the ads got past third-party verification scanners: a scanner that isn't a target sees nothing wrong. Discover-Tech appeared as a certified vendor across major exchanges, including Google, Yandex, and Beeswax. It had been listed as certified by Google and IAB Europe until it was removed after disclosure. Frank Dickson of Dickson Research says vetting often amounted to self-attestation. ## Who was hit At least 45 devices at Al Jazeera were infected between 2024 and 2025, using spyware from Candiru (rebranded Integrity Labs). Citizen Lab also names the mercenary firm Bindecy as an abuser of the platform. Reports differ on the platform: one account says iOS and Android devices were targeted, while another says the confirmed Al Jazeera infections were Windows computers. Exposed source code and leaked bidding records show the ads also reached networks tied to militaries, governments, critical infrastructure, the UN, NATO, the IAEA, and the International Criminal Court. Intel, Microsoft, and Apple-linked networks appear too. Whether any of those produced infections is unclear. The bidding data covers nearly four billion records. Discover-Tech's ads ran on almost 200,000 apps and websites (about 70,000 apps and 120,000 websites) across dozens of countries, including Yemen, Brazil, Mexico, and Czechia. Journalists and newsroom staff were among those profiled. The spyware can reportedly exfiltrate messages, photos, and emails, record calls, and turn on microphones. ## Related players The investigation links Discover-Tech to Bindecy and to Intelos, a vendor of advertising-based intelligence (ADINT). It also describes a separate actor, DARK CARTOGRAPHER, which exploits mobile carrier vulnerabilities to tie ad IDs to phone numbers for mass deanonymization. ## What defenders can do Citizen Lab urges at-risk people to block ads or disable ad tracking. Dickson recommends that enterprises: - block advertising identifiers - enforce DNS-level ad blocking - turn on Apple's Lockdown Mode for high-risk users - treat ad networks as untrusted vendors Other reporting, including Reuters on Meta ad fraud and Citizen Lab's work on Penlink geolocation tools bought by ICE, points to the same problem: the largely unregulated programmatic ad ecosystem is easy to turn into a surveillance tool. That has prompted calls for regulation and legislation. I find the verification gap the most troubling part. The system was built to catch bad ads, and a payload that only fires for chosen targets walks right past it. ## Questions this post answers ### What is the Controlium ad platform and how was it used to deliver spyware? Controlium is a platform branded by the Israeli advertising company Discover-Tech that let clients profile and deanonymize internet users through ordinary-looking online ads, then select targets for zero-click spyware delivery without requiring the victim to tap or open anything. Citizen Lab found that spyware vendors Candiru and Bindecy abused the platform, marking the first confirmed case of zero-click spyware delivered through an ad network. _Developers building ad-serving or adtech pipelines can follow security research like this on daily.dev to spot abuse patterns early._ ### How many devices at Al Jazeera were compromised by the Controlium spyware campaign? At least 45 Windows computers at Al Jazeera were compromised in 2024 and 2025 through the Controlium ad platform, with researchers believing dozens of devices there were affected. The spyware involved could reportedly pull messages, photos, and emails, record calls, and activate microphones on infected machines. _Security teams investigating targeted spyware campaigns can track incident reports like this one through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 139 comments across hackernews (as of 2026-10-16). **TL;DR:** Israeli firm's digital ads enabling installation of 'zero-click' spyware: The discussion largely treats this as confirmation that online advertising itself is a security threat, with deep technical interest in how zero-click exploits are delivered via ad networks, alongside a heated, often political argument about Israel's tech/security industry and geopolitics. Zero-Click Spyware Delivered via Targeted Ads: AdFection: The discussion is dominated by outrage over ad networks and ad tech enabling spyware delivery, with heavy debate over who should bear legal liability (ad providers, websites, or regulators) and skepticism about the technical details of how ads translate into device compromise. **Sentiment:** 3% positive · 20% mixed · 77% skeptical **The pushback** - Ad networks allow arbitrary JavaScript/HTML execution with little to no content sanitization between advertisers and publishers, which several called a basically unmitigated RCE risk. - Many argue ad providers and ad networks should face criminal/civil liability for delivering malware, not just fines. - Many argue this confirms ad-blocking is a necessary security practice, not just a convenience. - Some see this as part of a larger pattern of unchecked data harvesting and targeted advertising that should be banned outright. - Commenters note the same zero-day/exploit-broker ecosystem (exploit devs selling to spyware vendors) makes this a recurring, well-funded industry rather than a one-off incident. **By community** - hackernews (heated): Technical curiosity about how the ad-delivered exploit chain works quickly gives way to a long, contentious argument about Israel's tech industry, geopolitics, and whether coverage reflects bias, alongside widespread agreement that programmatic ad tech is a serious security liability. **Hottest debate:** Israeli firm's digital ads enabling installation of 'zero-click' spyware: Whether this incident reflects a broader pattern of Israeli state/security-service involvement in ad-tech and cybersecurity firms, versus commenters pushing back that this conflates a single company with an entire country or population. **Open questions** - Do standard ad blockers actually stop this specific zero-click delivery mechanism, especially within mobile apps versus browsers? - How exactly does a mobile ad lead to a DLL being executed on a victim's device? - Who were the actual clients paying Discover-Tech to target specific individuals/organizations? - What specific browser/OS vulnerabilities (beyond vague CVE mentions) are being exploited in this chain? - Why isn't there mandatory sanitization or sandboxing (e.g., disabling JavaScript) for ad content given how trivially it can be weaponized? **Highlights** > >During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses. Absolute morons. > — [sbdaman on hackernews](https://news.ycombinator.com/item?id=50104187) > Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal. How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold. And add jail time to fines. Fines means nothing for the rich. > — [Frieren on hackernews · 8 comments](https://news.ycombinator.com/item?id=50105140) > Apps should be required to disclose every single ad network they use as part of their app store disclosures. I want a lot more transparency as to where the ads are coming from inside the app itself. I've witnessed consumer apps throwing quite heinous malware/sketchware advertisements and watched the banners rotate between 4-5 different ad vendors to keep things hot and spicy. > — [kotaKat on hackernews · 1 comments](https://news.ycombinator.com/item?id=50104516) > It is standard that companies within a country act in the interests of its security services. Israel has a lot of ad-tech companies and thus it makes sense that they are roped into serving Israel's security services. It is no different that Israel's location tracking of StarLink terminals worldwide: https://www.newarab.com/news/israel-tech-firms-can-locate-an... This is the same issue that the US government has with Chinese networking companies, it is too easy for the Chinese government to pressure these Chinese networking companies to put in back doors in the interests of national security. The US likely knows this because it pressures its own companies in similar ways. > — [bhouston on hackernews · 2 comments](https://news.ycombinator.com/item?id=50103719) > Someone should look at mergers of large digital advertising companies after Trump's most recent election... And then look at the timing of it. The countries involved happened to be Israeli and have many employees based out of Argentina. Which is crazy since the United States, Israel and Argentina happened to become extremely close after that election cycle... The CTO happens to have worked for Radware https://radware.com/ https://www.innovid.com/about-us/news/mediaocean-completes-a... > — [the\_giraffe on hackernews · 1 comments](https://news.ycombinator.com/item?id=50105521) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50103000) · 225 points · 101 comments - [hackernews](https://news.ycombinator.com/item?id=50101813) · 203 points · 38 comments ## Similar posts on daily.dev - [Targeted advertising is also targeting malware](https://daily.dev/posts/targeted-advertising-is-also-targeting-malware-gegtugxsv) · CSO Online · 0 upvotes · 0 comments - [Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery](https://daily.dev/posts/intellexa-leaks-reveal-zero-days-and-ads-based-vector-for-predator-spyware-delivery-arp9flquy) · The Hacker News · 0 upvotes · 0 comments - [Who’s Tracking You? Use This New Service to Find Out – Krebs on Security](https://daily.dev/posts/who-s-tracking-you-use-this-new-service-to-find-out-krebs-on-security-imfod82bm) · Krebs on Security · 0 upvotes · 0 comments - [China-linked LightSpy spyware caught targeting victims in 13 countries, including the US](https://daily.dev/posts/china-linked-lightspy-spyware-caught-targeting-victims-in-13-countries-including-the-us-5bhsvtmbj) · TechCrunch · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Citizen Lab: Israeli ad platform Discover-Tech used to deliver zero-click spyware","url":"https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw"},"datePublished":"2026-10-15T13:35:44.135Z","dateModified":"2026-10-15T21:31:44.190Z","description":"Citizen Lab researchers at the University of Toronto report that an Israeli ad-tech company, Discover-Tech, operated a platform called Controlium that let...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/535e8d9ecef28aa9fdc7e8e790c4221e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/535e8d9ecef28aa9fdc7e8e790c4221e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Citizen Lab: Israeli ad platform Discover-Tech used to deliver zero-click spyware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/citizen-lab-israeli-ad-platform-discover-tech-used-to-deliver-zero-click-spyware-kkyp5xnjw#faq","mainEntity":[{"@type":"Question","name":"What is the Controlium ad platform and how was it used to deliver spyware?","acceptedAnswer":{"@type":"Answer","text":"Controlium is a platform branded by the Israeli advertising company Discover-Tech that let clients profile and deanonymize internet users through ordinary-looking online ads, then select targets for zero-click spyware delivery without requiring the victim to tap or open anything. Citizen Lab found that spyware vendors Candiru and Bindecy abused the platform, marking the first confirmed case of zero-click spyware delivered through an ad network. Developers building ad-serving or adtech pipelines can follow security research like this on daily.dev to spot abuse patterns early."}},{"@type":"Question","name":"How many devices at Al Jazeera were compromised by the Controlium spyware campaign?","acceptedAnswer":{"@type":"Answer","text":"At least 45 Windows computers at Al Jazeera were compromised in 2024 and 2025 through the Controlium ad platform, with researchers believing dozens of devices there were affected. The spyware involved could reportedly pull messages, photos, and emails, record calls, and activate microphones on infected machines. Security teams investigating targeted spyware campaigns can track incident reports like this one through daily.dev."}}]} ```