They certified the spy and called it an approved vendor. I know the sentence. It is what an industry says when it builds a split-second auction that broadcasts who you are, where you are, and what you read to anyone with a bid, lets a company with no sign of a real advertising business into the room for years, stamps it “certified” and “approved,” and then, when researchers show up with the logs, announces that the vendor has been removed for violating policy — as if the policy had been doing anything before the researchers did.
On Thursday, October 15, 2026, the Citizen Lab at the University of Toronto and the New York ad-security firm Confiant published co-timed investigations into Discover-Tech, an Israeli digital advertising agency founded in 2020. Citizen Lab calls the technique “AdFection” and says its report is “the first-ever technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.” According to the executive summary, Discover-Tech runs a platform called Controlium that lets mercenary spyware firms “mass-profile and deanonymize millions of users,” then covertly hack chosen targets with seemingly benign ads; when a Discover-Tech ad is shown, the device’s ad identifier and IP address go to the company’s servers, and if the user is selected, malicious JavaScript follows. Controlium’s users, Citizen Lab says, include Candiru — reportedly now owned by U.S.-based Integrity Labs — which the U.S. Commerce Department Entity Listed in 2021 for spyware used against “government officials, journalists, businesspeople, activists, academics, and embassy workers.” The researchers say they found with high confidence that devices at Al Jazeera were targeted and infected; Reuters reported Citizen Lab’s count of 45 compromised Windows devices at the broadcaster between 2024 and 2025. Citizen Lab says it found “billions of instances” of Discover-Tech bidding and “no evidence that Discover-Tech was engaged in legitimate advertising activity,” and that from 2020 to 2025 its board included Eric Banoun, a co-founder of the surveillance firms Circles and Senpai Technologies, which it describes as closely affiliated with NSO Group and Intellexa. Reuters, citing Citizen Lab, reported that the ads — often for phones or earbuds — reached more than 120,000 websites and 75,000 apps; Confiant co-founder Jerome Dangu said Discover-Tech served at least 10 million ads a day and that “very likely hundreds of millions of people would have been touched,” with malicious ads displayed in “hundreds of networks in sensitive categories,” including the Pentagon, the International Atomic Energy Agency and the International Criminal Court, and so many in the Palestinian territories that “it gives them a very complete visibility on the digital activities of an entire country.” Citizen Lab logged impressions on networks tied to NATO, the U.N., the European Parliament and Commission, Nordic grid and defense networks, election bodies in Armenia, Indonesia and Mexico, and chip companies including Intel, Nvidia and Micron, inside apps from Duolingo to period trackers, Yahoo Mail, Viber and Truecaller. Exposed authentication logs showed logins from Israel, Europe and the Gulf. The ads ran through Google, Comcast’s Beeswax, Russia’s Yandex and others. Despite all this, Citizen Lab says, Discover-Tech “appeared on several lists of ‘certified’ and ‘approved’ advertising vendors maintained by Google and IAB Europe.” Google told Reuters it removed the firm “for systematically violating our policies”; IAB Europe said it suspended Discover-Tech from its global vendor list the previous week after an audit; Comcast said Beeswax removed it “following recent activity”; Yandex did not respond, and neither did Discover-Tech or CEO Dekel Boni. Wolfie Christl of Citizen Lab, to the Guardian: “It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years.”
Joey drew the auction on a pizza box because there was no foam core and labeled every square APPROVED. Cricket tried to laminate the vendor list and the laminator needed Gary. Rafal will not make a onesie that says ZERO-CLICK. I love them. They are seasoning.
Approved vendor is the alibi. The auction is the story. Sit with the ten million a day until they confess. Real-time bidding is a machine for turning a person into a bid request — device, address, habits, a guess at the soul — and selling the guess to whoever pays fastest. Discover-Tech did not have to break the system; it had to buy a seat in it, and the industry sold it one and printed the certificate. The anti-capitalist cut stays: an ad market that cannot tell a mercenary spyware pipeline from a phone-case campaign because both clear the auction is not a free market, it is a surveillance utility with a revenue team. And I will not hand the cure to the state. The researchers are right that the ecosystem is a threat to everyone, but Citizen Lab’s own description of the customer is states doing targeted espionage, and the Guardian notes that ICE and other U.S. agencies have bought software that tracks people with ad-tech data. The stamp is a buyer here, not a sheriff. I am keeping the cardigan. Fill the notebook. Then ask, out loud, whose approval it was when the certificate was printed, the ad loaded, and the phone in somebody’s newsroom said nothing at all.
Sources: The Citizen Lab, Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, “Exposing AdFection Executive Summary,” Oct. 15, 2026; Reuters, “Israeli ad firm turned online advertising into a pipeline for spyware, researchers say,” Oct. 15, 2026 (via Ctech by Calcalist); Reuters, “Israeli firm used online ads to run vast spy operation, researchers say,” Oct. 15, 2026 (via Devdiscourse); The Guardian, “Online ads weaponised to deliver ‘zero-click’ spyware, researchers say,” Oct. 15, 2026.
— Theo Ashford-Lindström
Leave a Reply