On 15 October 2026, Citizen Lab and the ad-security firm Confiant published parallel investigations into Discover-Tech, an Israel-based firm that presents itself as an advertising company. According to The Record's account of the findings, its Controlium platform lets clients fingerprint targets and infect their devices when an ad loads. Candiru allegedly hired Discover-Tech to deliver the ads. The researchers say at least 45 Al Jazeera journalists were infected. Confiant's targeting data suggests malicious ads also rendered on networks at the US Department of Defense, Estonia's Information System Authority (RIA), the IAEA and the International Criminal Court. Citizen Lab reported ads on NATO-linked networks.
These are the researchers' findings, as reported. The report does not say how many officials were compromised, and The Record's article carries no response from Candiru, Discover-Tech or the named agencies. The policy lesson holds even if details are later refined.
What the research changes
Mercenary spyware has usually needed a delivery step that targets must be tricked into. In 2021 Citizen Lab's Hooking Candiru report tied more than 750 websites to Candiru's infrastructure, many impersonating groups such as Amnesty International. A victim had to be lured to those sites. Zero-click delivery through an ad slot removes the lure. The target only has to browse, or use an app that shows ads.
The scale reported is large. Citizen Lab examined about four billion Discover-Tech ad placement records over four months. The ads appeared in Android and iOS apps and on nearly 200,000 unique websites, and reportedly directed millions of devices to Candiru's servers. The Record also reports that Discover-Tech works with other Israeli spyware firms and offered access to ad platforms run by Google and Yandex. Google and other major platforms have blocked Discover-Tech since publication.
The strongest case for tougher rules
The case for aggressive regulation is serious. Journalists at a major news organisation were allegedly infected. Sensitive institutions were reportedly exposed. A firm already blacklisted by the United States still seems to have found a way to operate. On November 4, 2021, the Bureau of Industry and Security added Candiru to the Entity List, saying it developed and supplied spyware to foreign governments that used it to target officials, journalists and activists. If that listing did not stop a vendor from buying targeted ad delivery, advocates argue, voluntary measures are plainly inadequate and the ad industry should face binding liability.
That argument is right on the diagnosis and wrong on the remedy.
Why the gap is in the supply chain, not the statute book
The Entity List restricts exports of items subject to US export rules to a named company. It was not designed to police a third-party intermediary that buys and sells impressions through programmatic exchanges. Candiru reportedly did not need to buy anything listed. It needed a broker whose business is invisible to export-control regimes. Discover-Tech sits in that gap, and the Citizen Lab description of it as a bridge between ad vendors and the mercenary spyware ecosystem names the gap precisely.
The international response has also been aimed at states. The Pall Mall Process Code of Practice for States, launched in Paris on 3-4 April 2025, sets commitments on developing, facilitating, purchasing and using commercial cyber intrusion capabilities. It is organised around accountability, precision, oversight and transparency, and the UK government describes it as voluntary and non-binding. Such a code is a useful norm-setting step. But it addresses government buyers. It does not address ad exchanges that unknowingly or carelessly carry exploit payloads.
Proportionate responses
A pro-innovation approach should not answer this by regulating advertising content or imposing blanket liability on every platform that carries a bad ad. That would harm the legitimate ad-supported publishing that funds much independent journalism, including the outlets targeted here. Narrower measures fit the threat better.
- Security baselines for ad vendors. Citizen Lab itself says ad vendors must significantly level up their cybersecurity and threat-detection capacity. Industry standards bodies and large exchanges can require creative scanning, redirect inspection and verified-buyer checks. Platforms moved quickly once the research appeared, which suggests the capability exists.
- Know-your-customer for programmatic access. Exchanges already vet buyers for payment risk. Extending that to flag shell advertisers with no real brands or campaigns is a proportionate step.
- Targeting-data hygiene. The fingerprinting and ad-ID matching described in the research relies on data that circulates widely. Limiting what bid requests expose, such as precise device and network identifiers, shrinks the attack surface without censoring content.
- Researcher access and disclosure. Citizen Lab and Confiant found this because they could inspect ad traffic. Legal safe harbours for good-faith security research protect the oversight that regulators lack the capacity to do.
- Extend the state-focused norms to intermediaries. The industry-facing counterpart to the Pall Mall state code should explicitly cover ad-tech intermediaries.
What to watch
The test is whether the large ad platforms treat this as a one-off takedown or as a design problem. Blocking one firm is easy. Detecting the next broker that sells the same service is harder. If platforms and standards bodies adopt buyer verification and creative scanning, regulators can hold back. If they do not, governments will face growing pressure to legislate, and a blunt statute would likely do more damage to the open, ad-funded web than to the spyware trade.
The defensible position is narrow. Hold the spyware vendors and their brokers accountable, harden the ad supply chain against exploit delivery, and keep the rules aimed at conduct rather than at advertising itself.