Weaponized Advertising: How an Israeli Firm Exploited the Global Ad Ecosystem to Deliver Zero-Click Spyware

The researchers at Citizen Lab were blunt in their assessment of the firm’s true nature. They described Discover-Tech as a "bridge" between the shadowy world of mercenary spyware and the legitimate digital advertising economy. While the company maintained the outward appearance of a standard advertising business, the researchers found no evidence that it engaged in any legitimate commercial activities. Instead, they discovered billions of instances of Discover-Tech bidding to serve advertisements to users—a volume of activity that served only to facilitate the mass-profiling, de-anonymization, and eventual infection of specific targets.

The technical core of this operation was the Controlium platform. According to the investigation, Controlium served as a specialized toolkit for mercenary spyware firms. The process began with mass-profiling, where the platform would collect data on millions of users to identify specific individuals of interest. Once a target was identified, the platform used a process known as "fingerprinting" to determine the exact technical specifications of the target’s device, including its operating system, browser version, and hardware configuration. This information is critical for selecting the correct exploit to ensure a successful infection.

Once the target was profiled and their device fingerprinted, the platform would serve a seemingly harmless advertisement. Hidden within the code of this ad was malicious JavaScript. When the ad was rendered by the target’s device—whether inside a mobile app or a web browser—the JavaScript would execute automatically. This code would then exploit a vulnerability in the device’s software to gain unauthorized access and install the spyware. Because the entire process happens in the background during the normal loading of an ad, the user remains completely unaware that their device has been compromised.

The users of the Controlium platform include some of the most notorious names in the private surveillance industry. Among them is Candiru, an Israeli mercenary spyware firm that has recently come under the umbrella of the US-based Integrity Labs. Candiru has previously been blacklisted by the United States Commerce Department for developing and selling spyware used to target a broad spectrum of civil society, including government officials, activists, academics, and embassy workers. The link between Discover-Tech and Candiru illustrates the collaborative nature of the mercenary spyware market, where different firms specialize in different stages of the "kill chain"—from the initial delivery of the exploit to the long-term extraction of data.

Other firms linked to the platform include Bindecy, an Israeli company specializing in the discovery and weaponization of zero-click mobile exploits, and Intelos, another surveillance firm operating in the mercenary space. These connections suggest that Discover-Tech functioned as a critical infrastructure provider for the spyware industry, offering a delivery mechanism that was more reliable and harder to detect than traditional methods like SMS-based phishing.