Zero-Click Spyware Ads: What Discover-Tech's Bid Data Shows

Coverage of Citizen Lab's "AdFection" report has focused on the spyware: the lab says it links attacks on at least 45 Al Jazeera devices "with high confidence" to Candiru spyware delivered through targeted ads. The report's own bidding data adds a second story. Citizen Lab says the Israeli company behind the ads, Discover-Tech, bid on about 3.77 billion impressions in four months with no recorded conversions and almost no recorded revenue, and that it held "certified" and "approved" ad vendor status from 2020 until October 2026.

What Citizen Lab Found

The report, published Thursday, Oct. 15, calls itself "the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads." It says Discover-Tech's Controlium platform lets spyware vendors fingerprint and infect a device when an ad renders. TechCrunch and WIRED reported those findings, along with Google's removal of Discover-Tech from its ad platforms.

Citizen Lab also analyzed nearly four billion bidding records that Discover-Tech left publicly exposed on its own servers, covering March through June 2026. Citizen Lab calls the lack of any conversion in those records "highly unusual."

The Numbers Behind the Ads

Per the report, Discover-Tech's MyDSP platform bid on 3,770,286,576 impressions and appeared to win 441,954,291, or 11.7%. It spent about $109,091, assuming the cost field is recorded in micros of U.S. dollars, Citizen Lab's stated assumption.

By TradeFlock's calculation, which depends on that micros-of-USD assumption, the spend works out to about $0.25 for every 1,000 impressions won, or roughly $27,000 a month. TradeFlock did not benchmark that rate against industry norms, but it is the reported price of 442 million won impressions.

At least 718,748,885 of the bids, about 19%, were for ads that apparently carried a script tag pointing to a server Citizen Lab calls a NOAS server. Citizen Lab says that server returns code to eligible targets and an empty response to everyone else.

No Revenue in the Records, Citizen Lab Says

The database listed three advertisers. About 52.7% of bids ran under accounts labeled "discover-tech," by TradeFlock's addition of the report's table, and another 12.65% promoted MyIpInfo, a site the report links to Discover-Tech. The remaining 34.7% showed a generic AliExpress "SALE" creative showing Ugreen products that Citizen Lab judged was likely not bought by AliExpress or Ugreen.

The report says revenue fields were zero except for a three-day stretch in June and conversion fields were always zero, while allowing that the bidding records might not track conversions. Its conclusion: "In this case, there is no good evidence that Discover-Tech's MyDSP is earning money in this way."

Vetting That Missed It, per Citizen Lab

Citizen Lab says Google listed Discover-Tech among its roughly 2,400 certified external vendors, and IAB Europe added it to its Global Vendor List on July 2, 2020. the report says the IAB Europe listing ended on Oct. 8, 2026. The report says that listing potentially meant "for almost six years, hundreds of millions of Europeans were presented with a consent request" naming the firm. It adds that the lists "appear to be largely based on self-attestation by vendors."

Citizen Lab also says Discover-Tech holds a "Verified by TAG" badge from the Trustworthy Accountability Group as of October 2026. TradeFlock did not independently check TAG's registry, so that status is Citizen Lab's claim.

Google told WIRED it "blocked Discover-Tech from our ad platforms for systematically violating our policies." An IAB Europe spokesperson told WIRED the group suspended the vendor after an audit and added: "Further confirmation of the findings regarding spyware could also justify a definitive expulsion from the GVL." Comcast's Beeswax told Citizen Lab in a Oct. 13 reply that it had "already acted to remove Discover-Tech from Buyer Cloud," adding: "Malicious advertising of any kind is prohibited on our platform."

Who Saw the Ads, and What Is Unproven

About 24.7% of MyDSP's bids went through Google Ad Manager and 67.4% through Yandex, per the report. The impression data included networks at Intel, Nvidia, Micron, Apple and Microsoft, among others.

That list shows exposure, not compromise. In the report's words, "A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware." The report's technical confirmation concerns Al Jazeera: Citizen Lab says devices there were infected with Candiru spyware via Discover-Tech's ads, based on network logs the news network provided.

The report also notes that in 2021 Affle's Dubai unit acquired "business assets" from Discover-Tech Ltd, according to public filings, and that Affle did not respond. Citizen Lab says it has "no reason to believe that Affle has any control over Discover-Tech's malicious ad operations."

Responses From the Parties Named

Citizen Lab says Discover-Tech Ltd and Candiru, which the report says has rebranded as Integrity Labs, did not respond to its request for comment within the timeline provided. WIRED reported that emails and messages to Discover-Tech and its CEO went unanswered and that Integrity Partners, which it says is believed to own Candiru's assets, also did not respond. TechCrunch reported that Discover-Tech did not respond and that Integrity Labs could not be reached. TradeFlock has not independently verified Citizen Lab's findings.

For related reading, see TradeFlock on the $167 million Pegasus judgment, the Canadian ad tech case against Google and Interpol's warning on AI-driven cybercrime.

Cover photo: A smartphone in a leather case on a table. Photo: Santeri Viinamäki / Wikimedia Commons, CC BY-SA 4.0.