The dark side of online advertising conceals espionage tools

On 15 October 2026, two investigations carried out by Citizen Lab at the University of Toronto and the cyber security firm Confiant have brought to light a surveillance system that is forcing governments to rethink the traditional categories used to assess digital threats. The Israeli company Discover-Tech, operating in the online advertising market, is alleged to have used automated advertising infrastructure to identify devices, gather information and facilitate the distribution of spyware linked to Candiru, an Israeli company subject to trade restrictions imposed by the United States in November 2021. The model is zero-click.

For over a decade, the digital economy has been building systems capable of recognising devices, analysing behaviour and distributing adverts through thousands of intermediaries. This architecture, designed to make the advertising market more efficient, has gradually acquired features that are being exploited for intelligence-gathering activities. The difference lies in the purpose: the very same mechanisms that enable an advertiser to reach a consumer can allow a surveillance operator to identify a target and, under certain technical conditions, attempt to compromise their device. The consequences directly affect national security, the protection of industrial supply chains, the confidentiality of diplomatic communications and the integrity of financial infrastructure. The problem concerns not only what an attacker can steal by breaching a secure system, but also what they can learn without breaching it, by using information already available through ordinary commercial dealings.

Citizen Lab collected data on the ad market between March and June 2026 relating to the case in question: 3,770,286,576 public auctions, of which 441,954,291 were successful, distributed across an ecosystem comprising 120,768 websites and 75,373 mobile applications. 76.7 per cent of the bids therefore related to mobile applications, whilst the remaining 23.3 per cent concerned web environments. In the sample analysed, Yandex accounted for 67.4% of transactions attributable to ad exchanges, Google Ad Manager for 24.74% and Vungle for 7.24%.

The geographical distribution reveals significant concentrations. Yemen, Pakistan and Montenegro recorded 457.3 million, 139.4 million and 97.6 million adverts respectively in the segment examined. When this figure is relative to population, Montenegro reached 156.68 adverts per inhabitant. These figures represent the scope of the issue in question. It is not known how many of the devices reached via the advertising ID recognition system were affected. Certainly only a small proportion, but in absolute terms this would still represent a high number of offences.

The most significant evidence concerns the broadcaster Al Jazeera. We need to look back at the previous two years. Between 2024 and 2025, at least 45 devices were reportedly involved in attacks that Citizen Lab linked to Candiru spyware, distributed via the Discover-Tech advertising network. Analysis of network logs is said to have enabled the reconstruction of links between adverts, device verification infrastructure and servers associated with the spyware.