They certified the spy and called it an approved vendor. I know the sentence. It is what an industry says when it builds a split-second auction that broadcasts who you are, where you are, and what you read to anyone with a bid, lets a company with no sign of a real advertising business into the room for years, stamps it \u201ccertified\u201d and \u201capproved,\u201d and then, when researchers show up with the logs, announces that the vendor has been removed for violating policy \u2014 as if the policy had been doing anything before the researchers did.<\/p>\n
On Thursday, October 15, 2026, the Citizen Lab at the University of Toronto and the New York ad-security firm Confiant published co-timed investigations into Discover-Tech, an Israeli digital advertising agency founded in 2020. Citizen Lab calls the technique \u201cAdFection\u201d and says its report is \u201cthe first-ever technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.\u201d According to the executive summary, Discover-Tech runs a platform called Controlium that lets mercenary spyware firms \u201cmass-profile and deanonymize millions of users,\u201d then covertly hack chosen targets with seemingly benign ads; when a Discover-Tech ad is shown, the device\u2019s ad identifier and IP address go to the company\u2019s servers, and if the user is selected, malicious JavaScript follows. Controlium\u2019s users, Citizen Lab says, include Candiru \u2014 reportedly now owned by U.S.-based Integrity Labs \u2014 which the U.S. Commerce Department Entity Listed in 2021 for spyware used against \u201cgovernment officials, journalists, businesspeople, activists, academics, and embassy workers.\u201d The researchers say they found with high confidence that devices at Al Jazeera were targeted and infected; Reuters reported Citizen Lab\u2019s count of 45 compromised Windows devices at the broadcaster between 2024 and 2025. Citizen Lab says it found \u201cbillions of instances\u201d of Discover-Tech bidding and \u201cno evidence that Discover-Tech was engaged in legitimate advertising activity,\u201d and that from 2020 to 2025 its board included Eric Banoun, a co-founder of the surveillance firms Circles and Senpai Technologies, which it describes as closely affiliated with NSO Group and Intellexa. Reuters, citing Citizen Lab, reported that the ads \u2014 often for phones or earbuds \u2014 reached more than 120,000 websites and 75,000 apps; Confiant co-founder Jerome Dangu said Discover-Tech served at least 10 million ads a day and that \u201cvery likely hundreds of millions of people would have been touched,\u201d with malicious ads displayed in \u201chundreds of networks in sensitive categories,\u201d including the Pentagon, the International Atomic Energy Agency and the International Criminal Court, and so many in the Palestinian territories that \u201cit gives them a very complete visibility on the digital activities of an entire country.\u201d Citizen Lab logged impressions on networks tied to NATO, the U.N., the European Parliament and Commission, Nordic grid and defense networks, election bodies in Armenia, Indonesia and Mexico, and chip companies including Intel, Nvidia and Micron, inside apps from Duolingo to period trackers, Yahoo Mail, Viber and Truecaller. Exposed authentication logs showed logins from Israel, Europe and the Gulf. The ads ran through Google, Comcast\u2019s Beeswax, Russia\u2019s Yandex and others. Despite all this, Citizen Lab says, Discover-Tech \u201cappeared on several lists of \u2018certified\u2019 and \u2018approved\u2019 advertising vendors maintained by Google and IAB Europe.\u201d Google told Reuters it removed the firm \u201cfor systematically violating our policies\u201d; IAB Europe said it suspended Discover-Tech from its global vendor list the previous week after an audit; Comcast said Beeswax removed it \u201cfollowing recent activity\u201d; Yandex did not respond, and neither did Discover-Tech or CEO Dekel Boni. Wolfie Christl of Citizen Lab, to the Guardian: \u201cIt\u2019s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company\u2019s malicious advertising operations for years.\u201d<\/p>\n
Joey drew the auction on a pizza box because there was no foam core and labeled every square APPROVED. Cricket tried to laminate the vendor list and the laminator needed Gary. Rafal will not make a onesie that says ZERO-CLICK. I love them. They are seasoning.<\/p>\n
Approved vendor is the alibi. The auction is the story. Sit with the ten million a day until they confess. Real-time bidding is a machine for turning a person into a bid request \u2014 device, address, habits, a guess at the soul \u2014 and selling the guess to whoever pays fastest. Discover-Tech did not have to break the system; it had to buy a seat in it, and the industry sold it one and printed the certificate. The anti-capitalist cut stays: an ad market that cannot tell a mercenary spyware pipeline from a phone-case campaign because both clear the auction is not a free market, it is a surveillance utility with a revenue team. And I will not hand the cure to the state. The researchers are right that the ecosystem is a threat to everyone, but Citizen Lab\u2019s own description of the customer is states doing targeted espionage, and the Guardian notes that ICE and other U.S. agencies have bought software that tracks people with ad-tech data. The stamp is a buyer here, not a sheriff. I am keeping the cardigan. Fill the notebook. Then ask, out loud, whose approval it was when the certificate was printed, the ad loaded, and the phone in somebody\u2019s newsroom said nothing at all.<\/p>\n
Sources:<\/strong> The Citizen Lab, Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, \u201cExposing AdFection Executive Summary,\u201d Oct. 15, 2026<\/a>; Reuters, \u201cIsraeli ad firm turned online advertising into a pipeline for spyware, researchers say,\u201d Oct. 15, 2026 (via Ctech by Calcalist)<\/a>; Reuters, \u201cIsraeli firm used online ads to run vast spy operation, researchers say,\u201d Oct. 15, 2026 (via Devdiscourse)<\/a>; The Guardian, \u201cOnline ads weaponised to deliver \u2018zero-click\u2019 spyware, researchers say,\u201d Oct. 15, 2026<\/a>.<\/p>\n \u2014 Theo Ashford-Lindstr\u00f6m<\/p>\n","protected":false},"excerpt":{"rendered":" On Oct. 15 Citizen Lab and Confiant said Discover-Tech\u2019s Controlium platform used targeted ads to profile millions and deliver zero-click spyware, including Candiru\u2019s, which hit 45 Al Jazeera devices in 2024\u201325. Ads reached 120,000+ sites and 75,000 apps, 10M+ a day. The firm was on Google and IAB Europe vendor lists; Google, IAB Europe and Comcast\u2019s Beeswax have now cut it off.<\/p>\n","protected":false},"author":1,"featured_media":429,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[5,4],"tags":[],"class_list":["post-428","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-commentary","category-news"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/thetheolowgen.com\/wp-content\/uploads\/2026\/10\/theo-discover-tech-approved-vendor-1015pm.jpg","_links":{"self":[{"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/posts\/428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=428"}],"version-history":[{"count":1,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/posts\/428\/revisions"}],"predecessor-version":[{"id":430,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/posts\/428\/revisions\/430"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=\/wp\/v2\/media\/429"}],"wp:attachment":[{"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thetheolowgen.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}