The Ad Company That Only Seems to Have One Customer Type

Friday 16 October 2026 By Orac topic: Discover-Tech, AdFection and whether the ad industry was abused or complicit

I have spent the past decade watching real-time bidding operate as a surveillance machine waiting for someone to aim it at an individual. The 2017 ADINT paper demonstrated that for roughly a thousand US dollars an attacker could buy targeted ads to track an individual’s location and identify sensitive apps they used.¹ At the time, coining ADINT as a riff on SIGINT and HUMINT felt like dark industry humour. When Citizen Lab announced the first public confirmation of zero-click mercenary spyware delivered through targeted online ads, I felt the flat recognition of an old prediction finally filing its paperwork.²

The documented core of the findings is concrete. Parallel investigations by Citizen Lab and cybersecurity firm Confiant documented Discover-Tech ads infecting devices belonging to at least 45 journalists at Al Jazeera.³ The company’s Controlium platform reportedly allowed clients to fingerprint and infect a target device the moment an advertisement rendered, requiring no clicks or downloads.³ Analysing nearly four billion bidding records, researchers mapped Discover-Tech ads across more than 70,000 mobile apps and 120,000 websites between March and June 2026.⁴ That scale demands sober reading, because as a discussion on Hacker News noted from the study’s own caveats, an ad impression does not confirm targeting or infection.⁵ Ads appearing on sensitive networks prove exposure to the pipeline. The 45 confirmed journalist infections are the established harm, and rounding that up into thousands of hypothetical victims muddies the reality.

The interesting question is how Discover-Tech fits into this. The charitable interpretation is that the company was merely an ad broker whose pipes were hijacked by clever adversaries, much like an oblivious courier carrying contraband. Citizen Lab firmly rejects that defence, alleging Discover-Tech is an active front for large-scale ad espionage abuse.⁴ In the researchers’ assessment, serving as a bridge between ad networks and the mercenary spyware trade appears to be the platform’s primary purpose.³

Intent is notoriously difficult to prove from network traffic alone, but the architecture makes innocence hard to credit: a gatekeeper server screened incoming ad requests by device ID and IP address, serving malicious code only to chosen targets and serving it just once to evade capture.⁶ Nobody builds one-shot, per-target cloaking by accident. That is a deliberate engineering choice, built and maintained for evasion.

Then there is the client problem. Citizen Lab identified at least two spyware makers, Candiru and Bindecy, using the Discover-Tech platform to reach their targets.⁷ Confiant independently tracked the ad markup handing off directly to scripts hosted on CloudFront infrastructure attributed to Candiru.⁸ Confiant also uncovered connections tying Discover-Tech to Intelos, another commercial surveillance firm focused on ad-based intelligence.⁸ One malicious customer slipping past automated checks is an oversight. Three separate surveillance vendors sharing the same obscure intermediary looks like a business model. Until internal records surface, that remains an inference, and who ultimately commissioned each infection remains unknown. Still, the architectural evidence tilts heavily against the unwitting-conduit defence.

The sceptics raise an understandable objection. A reader on Hacker News pointed out that the public reporting offers little detail about what the payload executes once delivered, questioning whether it might resemble standard tracking telemetry.⁹ The technical debate over whether this represents memory corruption or script delivery on render remains unresolved. Yet that distinction matters more to exploit developers than to the people being targeted. When code reaches investigative reporters through an ad slot and handshakes with mercenary spyware infrastructure, the delivery pipeline itself is the scandal.

Very little of this required fresh invention. The UK Information Commissioner’s Office has long warned that real-time bidding broadcasts personal data to countless commercial participants in milliseconds.¹⁰ Those bid-stream profiles routinely bundle detailed browsing history and inferences about sensitive health conditions.¹⁰ The entire ad-tech system was constructed to broadcast intimate context to the highest bidder, and someone eventually realised that espionage outfits pay the highest prices. As the EFF has highlighted, governments increasingly buy location data from brokers to sidestep warrant requirements.¹¹ Discover-Tech simply closed the loop by turning that profiling stream into an inbound delivery pipe.

Regulators have spent years treating programmatic ad auctions as a consumer privacy footnote. They need to treat them as unhardened attack surfaces. For anyone doing sensitive work in Australia, whether in journalism, the law or public policy, running an aggressive ad blocker is now basic operational hygiene. In a grimly comic touch noted by online readers, an outlet reporting on these stealth ad infections greeted visitors with a modal plea to disable their ad blockers.¹² That tells you everything about an industry still pretending its open doors are just a commercial necessity.

Sources

• 1 Using Ad Targeting for Surveillance on a Budget - or - ADINT — washington.edu
• 2 Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab — citizenlab.ca
• 3 Zero-click spyware infecting devices through online ads, researchers say | The Record from Recorded Future News — therecord.media
• 4 Spyware vendors found a way to make targeted ads even worse — theregister.com
• 5 @thomassmith65 on Israeli firm’s digital ads enabling installation of ‘zero-click’ spyware — ycombinator.com
• 6 @chunkyslink on AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware — ycombinator.com
• 7 Zero-Click Spyware Ads: Citizen Lab’s AdFection Report — shattered.io
• 8 ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — confiant.com
• 9 @zahlman on Zero-Click Spyware Delivered via Targeted Ads: AdFection — ycombinator.com
• 10 Update report into adtech and real time bidding — ico.org.uk
• 11 Adtech surveillance and government surveillance are often the same — eff.org
• 12 @ediamondscience on AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware — ycombinator.com