Discover-Tech Zero-Click Spyware Delivered Through Online Ads, Citizen Lab and Confiant Find
What happened
Security researchers at Citizen Lab and Confiant published a joint investigation finding the first technical evidence that a zero-click attack — hacking that requires no action from the victim — was delivered through targeted online advertising. The ad tech firm at the center of the operation is Discover-Tech, an Israeli company that presents itself as a conventional online advertising agency.
The investigation, reported by The Verge on October 15, 2026, and earlier by NBC News, describes Discover-Tech as a pipeline that lets hacking groups plant malicious ads across the web. Google and the Comcast-owned advertising company Beeswax have since removed Discover-Tech from their platforms, and IAB Europe suspended the company from its list of approved vendors, according to Reuters.
How the ad pipeline worked
Discover-Tech operates a platform called Controlium, which the researchers say gives its spyware partners the ability to "precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking."
Controlium also lets partners "select a user for infection or profiling" using an IP address, a mobile ad ID, or a browser identifier. In practice, that means the targeting data that ordinary ad tech collects for advertising purposes — device fingerprints, persistent identifiers, IP addresses — can be repurposed as a victim-selection mechanism for malware delivery.
The key novelty is the delivery channel, not the spyware itself. Ad networks have long been abused to serve malvertising, but the researchers describe a system where the ad impression itself is the infection vector, with no click, tap, or download required from the target.
Who was targeted
One of the groups working with Discover-Tech is Candiru, an Israeli spyware vendor that has been blacklisted by the US government. In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, the Qatar-based news network.
Researchers say the operation targeted "at least" 45 devices at the news outlet across 2024 and 2025. Journalists and news organizations are a recurring target class for commercial spyware, which makes the Al Jazeera infections consistent with the broader pattern of mercenary surveillance against the press.
What the researchers are asking for
Citizen Lab and Confiant call on the advertising industry to ramp up security on its platforms. The specific asks are not detailed in the news coverage, but the framing is that ad exchanges and demand-side platforms need to treat creative delivery and targeting infrastructure as a security boundary rather than a purely commercial function.
The enforcement actions that followed are notable because they came from the ad industry itself rather than from regulators: Google and Beeswax removed Discover-Tech from their platforms, and IAB Europe — the trade body that maintains an approved-vendor list — suspended the company.
Why this matters beyond one vendor
The significance of the finding is structural. Ad tech exists to identify, profile, and reach specific people across millions of websites and apps, and it does so with identifiers that persist across contexts. That is functionally the same capability set a spyware operator needs to select and reach a target.
A zero-click delivery path through advertising also breaks a common defensive assumption. Advice to users has long centered on not clicking suspicious links or not opening unknown attachments. If the impression itself is the payload, then user behavior is not part of the kill chain at all, and the mitigations have to move to the platform and browser layer.
Practitioner takeaways from the Hacker News discussion
The Hacker News thread on the story (199 points, 87 comments) converged on a small number of practical points.
Ad blocking is treated as baseline hygiene, not an optional extra. One commenter argued the researchers' recommendation was too soft:
"Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs." Not "recommend". Everyone must use uBlock Origin or at least some type of ad blocker in every device. Then also mandatory pi-hole on every house. Even if you are used by Windows OS, you must use an adblocker. Even if you use Chrome. On every browser.
The same commenter's framing — that ad blocking should be universal rather than reserved for high-risk individuals — is the practical counterpoint to the article's risk-based recommendation.
The discussion also asked why Israel produces so much offensive cyber capability. One commenter speculated that sustained existential threat pushed the country to develop the capability early, and that once such organizations exist they are hard to control:
My question is, why is Israel so good at this? It seems to be at least the 4th cyber power of the world, after the US, Russia and China, if not actually on par or better. I guess it is because it has been under the threat of larger enemies from its birth, so it must leverage whatever it has to survive. And once you grow an organization and let it loose, you don't have much control over it anymore, and it grows in the wild like a flower.
At least one commenter disputed the credibility of the primary source. A commenter linked to an LSE research repository paper and wrote that "Citzen Lab isn't always the most reliable source." The link was not accompanied by a specific critique of the methodology in this investigation, so the objection is a general credibility challenge rather than a rebuttal of the specific findings.
A duplicate submission was flagged. One commenter noted the story had already been posted to Hacker News under a different item ID.
Caveats and open questions
The public reporting summarizes the Citizen Lab and Confiant findings; the underlying technical writeups are the primary sources for the mechanism of delivery. The Verge article is partially paywalled, so some detail beyond the summary above may sit behind its subscription wall.
Several questions remain open in the public record: how many individuals outside Al Jazeera were profiled or infected through Controlium, whether the targeting was limited to specific high-value individuals or ran more broadly, and what technical changes ad exchanges would need to make to prevent an impression from functioning as an exploit delivery path. The enforcement actions taken by Google, Beeswax, and IAB Europe address one vendor, not the underlying capability of ad targeting infrastructure to serve as a zero-click attack surface.