Link: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

A joint investigation by the University of Toronto's Citizen Lab and cybersecurity firm Confiant has exposed a massive Israeli spy operation. The report, published on October 15, 2026, reveals how an Israeli advertising company called Discover-Tech weaponized the global online ad network to plant spyware on devices without any user interaction.

The technique is called "AdFection." It is the first public confirmation of a "zero-click" mercenary spyware attack delivered through targeted ads. This means a device is infected simply by an ad loading on a website or app. The user does not need to click anything. Once infected, the spyware can steal files, documents, browser data, keystrokes, screenshots, and even record microphone and webcam input.

The spyware used was from Candiru, an Israeli spyware firm blacklisted by the United States government in 2021. Candiru has rebranded as "Integrity Labs." The Citizen Lab confirmed that at least 45 Windows devices at Al Jazeera were compromised between 2024 and 2025. Al Jazeera journalists, including those reporting on sensitive subjects, were among the targets.

Discover-Tech presents itself as a legitimate advertising company. But researchers found it operates as a facilitator for multiple mercenary spyware partners. Its platform, called Controlium, allows partners to "de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered." Over a four-month period, Discover-Tech's ads were shown on almost 200,000 unique websites and apps in dozens of countries.

The report also found that Discover-Tech's ads appeared on networks used by the Pentagon, the United Nations International Atomic Energy Agency (IAEA), and the International Criminal Court (ICC). A separate threat actor called "DARK CARTOGRAPHER" is using Discover-Tech's infrastructure to link device advertising IDs with phone numbers, mass-de-anonymizing internet users.

Al Jazeera condemned the attacks. The network said targeting journalists is an "assault on press freedom" and called for those responsible to be held accountable. Google, IAB Europe, Beeswax, and other ad vendors have taken action to disconnect Discover-Tech from their advertising ecosystems.

This is not just a cybercrime. It is a state-linked attack on the free press. An Israeli company built a pipeline to hack journalists, activists, and anyone else it targeted, and it did so through the everyday ads we all see online. The infrastructure was hidden in plain sight, approved by major ad networks, and used to spy on the people who document Israel's crimes.

More: https://www.youtube.com/watch?v=oTNqhH4KzxY

[The Scope of the Allegations: Beyond Intel and AMD#

Most commonly referenced are the Intel Management Engine (ME) and AMD Platform Security Processor (PSP)—tiny, low-power processors embedded inside CPUs since roughly 2008. Operating independently from the main CPU cores and accessible below the OS level, these subsystems have privileged access to the entire system.

Intel Management Engine (ME): Integrated in virtually all Intel CPUs since 2008, ME runs an isolated microcontroller with its own firmware and operating system. It can access memory, devices, network traffic, and more, all while remaining invisible to the OS, including Linux.

AMD PSP: AMD’s counterpart includes a dedicated ARM core tasked with secure boot, encryption, and system management functions. While architecturally different, it also operates beneath OS oversight with similarly deep system access.

Apple Silicon: Apple's custom ARM-based chips incorporate secure enclave processors and extensive system controllers for security and DRM purposes. Though not proven explicitly backdoored, their closed nature and hardware control raise similar concerns.

The embedded management processors, initially designed for legitimate security and remote management features, create invisible vectors that sophisticated actors could exploit. Since these subsystems run independently of the main OS, no software defense—even a hardened Linux installation—can completely protect the system once compromised at this low hardware level.](https://www.indiekings.com/2025/08/linux-wont-save-you-nsas-backdoors-in.html)

So how are they doing these exploits?