Discover‑Tech ad campaign used EU and NATO sites to route devices toward Candiru spyware

An Israeli surveillance-technology operation used online ads to reach and potentially infect millions of mobile phones, researchers found — with the same ad placements appearing on official NATO and EU websites.

How the ad-based hack worked

Investigators identified a technique they called "AdFection," a method that weaponises the online advertising ecosystem to find and funnel targets toward spyware. The operation centred on an Israeli company called Discover-Tech, whose ad platform, Controlium, reportedly allowed spyware vendors to identify, track and target devices by serving or redirecting ads on websites and mobile apps.

Bill Marczak, a senior researcher at Citizen Lab, warned about the implications: "Integration into the online advertising ecosystem provides the mercenary spyware industry with a covert delivery system." He added the findings were "surely only the tip of the iceberg" for how ads are abused for espionage.

The investigation examined devices belonging to journalists and staff at the Al Jazeera media network and found that 45 devices were targeted in the campaign; some of those devices were infected with Israeli-made spyware known as Candiru. The report notes that Candiru was acquired in 2025 by Integrity Labs.

Analysis of four billion ad records showed Discover-Tech ads appearing on nearly 200,000 websites and mobile apps across dozens of countries during a four-month period. The list of sites where the ads ran included official pages of NATO, the United Nations, the European Parliament, the European Commission and the Council of the EU.

The scheme relied on automated real-time bidding systems used by ad platforms to buy space and target users. Instead of tricking victims into clicking a malicious link, attackers used ads to identify — and in some cases infect — devices without user interaction, a so-called zero-click infection. Researchers say millions of devices were redirected toward servers linked to Candiru, potentially enabling widespread surveillance, though not all redirected devices were necessarily infected.

The findings have prompted calls for deeper probes. "The possibility that EU institutions were exposed should trigger an alarm across Brussels," said Hannah Neumann, a German Member of the European Parliament from the Greens. Neumann added: "Europe cannot claim to defend democracy while at the same time leaving its own democratic institutions vulnerable to spyware."

Photo: press material from the event