1. Executive summary
Citizen Lab and Confiant published parallel investigations into Discover-Tech, an Israel-based firm that used digital advertising to deliver zero-click spyware on behalf of the mercenary spyware vendor Candiru. The research documents infections of at least 45 Al Jazeera journalists and ad impressions on the internal networks of NATO, the U.S. Department of Defense, Estonia's Information System Authority (RIA), the IAEA and the International Criminal Court. No CVSS score, CVE, CISA KEV entry or exploitation state is available for this item; the VERIFIED REFERENCE DATA resolved nothing, so this advisory makes no severity or exploitation assessment. The risk to EMEA financial services is indirect: the delivery mechanism is programmatic advertising, which most institutions run on corporate networks and managed mobile fleets, and the same ad supply chain that reached government and international-organisation networks is not segmented away from banking estates by default.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | The attack path runs through ad tech intermediaries (Discover-Tech, ad platforms hosted by Google and Yandex) that sit in the ICT supply chain of any firm serving ads to staff devices. | Firms must be able to identify which ad tech providers are in scope, and hold contractual and monitoring coverage over them. |
| NIS2 Art. 21(2)(d): supply chain security measures | Discover-Tech served ads onto the internal networks of government agencies and international organisations, meaning the supplier relationship was the entry point rather than a direct compromise. | Supply chain security measures must extend to advertising and content-delivery suppliers, not only to core IT vendors. |
No other article in the regulatory reference passes the test. DORA Art. 17, 18 and 19 are incident-management and reporting obligations that engage only once a firm has a confirmed incident; this item reports third-party research, not a client incident. DORA Art. 24, 29 and 30 and NIS2 Art. 23 and UK NIS 2018 are not triggered by any fact specific to this item.
3. Technical analysis & attack chain
The chain below is what the two investigations describe. Steps are confirmed by the reporting unless marked otherwise.
- A target is identified. Discover-Tech's platform, Controlium, deanonymises and fingerprints devices. Deanonymisation matches encrypted or pseudonymous data against public data to unmask an individual.
- An ad is served to that device. The ad is placed through normal programmatic channels, including Android and iOS apps and, across a four-month window, nearly 200,000 unique websites. Citizen Lab analysed four billion Discover-Tech ad placement records.
- The ad renders and malicious JavaScript executes automatically. Citizen Lab describes this as a zero-click attack: infection occurs the moment the advertisement is displayed, with no user interaction.
- The device is directed to Candiru infrastructure. The ads "covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance," per the report.
- Post-compromise capability. Controlium lets spyware clients record calls, activate microphones, and exfiltrate messages and emails.
Two design details matter for defenders. Discover-Tech avoids "directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads," which means the ad platform and the publisher are not positioned to inspect the payload. And the platform serves as a bridge between ad vendors and the mercenary spyware ecosystem, which removes two traditional barriers: the restriction on who may buy spyware (government customers only) and the need for social engineering to gain access.
The reporting does not name the exploited component, a CVE, a browser or OS version, a user agent, a JavaScript payload, a command-and-control domain, or a file hash. Nothing in the source material supports a vulnerability-level mechanism, so none is asserted here.
Attribution caveat. Candiru is named as the spyware vendor and Discover-Tech as the ad delivery firm, with Candiru allegedly hiring Discover-Tech to send the ads. The VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for either entity, so the attribution is unconfirmed for our purposes. The claim that Discover-Tech also worked with other Israeli spyware companies is single-sourced to Citizen Lab. Google and other major platforms have blocked Discover-Tech following the research; that is a platform action, not a legal finding.
Exposure caveat. Confiant's targeting analysis found evidence suggesting the malicious ads rendered on networks at the U.S. Department of Defense, Estonia's RIA, the IAEA and the International Criminal Court. The report does not state how many officials' devices were compromised, and rendering on a network is not the same as infection. Treat the government and international-organisation exposure as ad-impression evidence, not confirmed compromise.
4. Mitigation & containment
P1 (within 24 hours)
- Inventory where programmatic advertising renders on corporate networks and managed mobile devices. The delivery vector is ad rendering, so the control point is the ad path, not the endpoint alone.
- Block Discover-Tech ad infrastructure at the DNS and secure web gateway layer. The sources do not publish domains or IPs, so this must be built from your ad tech vendor's blocklist feed and from platform enforcement notices rather than from this advisory.
- Ask your ad tech and mobile app suppliers whether Discover-Tech or Controlium appears in their demand-side or supply-side inventory, and request written confirmation of removal.
P2 (within 72 hours)
- Disable programmatic ad rendering on managed mobile fleets and on any device with access to internal networks. This is the single control that breaks the chain described in §3 step 3.
- Segment advertising and content-delivery traffic away from internal networks. The government and international-organisation exposure in this item came from ads reaching internal networks, not from targeted phishing.
- Review mobile device management policy for call recording, microphone and messaging access by non-approved applications, since those are the capabilities Controlium exposes.
P3 (within 7 days)
- Add advertising and content-delivery suppliers to the ICT third-party register and to supply chain risk assessment, per DORA Art. 28 and NIS2 Art. 21(2)(d).
- Brief communications, legal and executive staff who are plausible targets for commercial surveillance, given the documented targeting of journalists, dissidents and embassy staff.
No vendor patch exists for this item. There is no CVE and no fixed version to pin. The mitigation is architectural.
5. Indicators of compromise
No indicators of compromise available in the source material. The reporting names no domains, IP addresses, URLs, file hashes, file paths, registry keys or process names.
The sources describe observable behaviours but no atomic indicators. Those are listed separately below and are not machine-pivotable.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Ad render triggers automatic outbound contact to an external server with no user interaction | Secure web gateway, DNS logs, mobile network telemetry | Single-sourced (Citizen Lab); verify before enforcement |
| Ad creative served without the malicious code or a pointer to it being shared with the ad platform or publisher | Ad tech supplier disclosure, not directly observable on the endpoint | Single-sourced (Citizen Lab) |
| Call recording, microphone activation, and message or email access by an application not approved for those permissions | MDM telemetry, mobile OS permission audit logs | Single-sourced (Citizen Lab) |
6. Detection
Insufficient indicators to author detection rules. The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values. The only named artefacts are company and product names (Discover-Tech, Controlium, Candiru), which are reporting subjects rather than threat artefacts, and a rule built on them would detect coverage of this story rather than the activity it describes.
7. Sources
- The Record, "Zero-click spyware infecting devices through online ads, researchers say", https://therecord.media/spyware-citizen-lab-advertising, 2026-10-15
- Citizen Lab, investigation into Discover-Tech and Controlium, referenced in the above; primary report URL not supplied in the source material
- Confiant, targeting data analysis, referenced in the above; primary report URL not supplied in the source material
8. Adverse Trace position
We assess this as a supply chain exposure rather than a directly exploitable vulnerability for EMEA financial services clients. There is no CVE, no CVSS score, no CISA KEV entry and no exploitation state in the verified data, so we are not assigning a severity rating and we are not treating the government and international-organisation network references as confirmed compromise. The attribution to Candiru and Discover-Tech rests on Citizen Lab and Confiant reporting and has no MITRE profile in our reference data; we treat it as unconfirmed. The exposure that does apply to our clients is the ad rendering path on managed mobile devices and corporate networks, and the third-party register gap that DORA Art. 28 and NIS2 Art. 21(2)(d) put in scope. We will request the primary Citizen Lab and Confiant reports for the technical artefacts this advisory lacks, and we will issue a follow-up with atomic indicators and detection rules if those reports publish domains, hashes or payload strings. Clients who need a decision before then should treat programmatic ad rendering on managed fleets as the control point and act on P1 today.
Published via PulseTrace — Adverse Trace threat intelligence.