Loading story…
Citizen Lab and Confiant linked advertising operator Discover-Tech and its Controlium platform to large-scale identity collection and infrastructure supporting potential zero-click spyware delivery. An advertisement detected on April 12, 2026, led to infrastructure Citizen Lab attributed to Candiru, exposing an encrypted command-and-control framework capable of device fingerprinting, behavioral monitoring, and executing operator-supplied JavaScript. Discover-Tech also collected readable first-party cookies, including authenticated session identifiers and personal information, across more than 1,000 publisher domains, sometimes without GDPR consent. Researchers estimated its reach at 10 million daily ad impressions; exposed bidding records showed Discover-Tech-linked ads containing attacker script tags across more than 70,000 mobile apps and 120,000 websites between March and June.
Researchers estimated that millions of devices were directed to Candiru servers for potential profiling, while Candiru-linked campaigns were smaller and geographically selective. Discover-Tech ad impressions reached government, military, international organization, and critical infrastructure networks, but exposure does not establish targeting or compromise, and not every advertisement was necessarily weaponized. Confiant did not capture a complete exploit chain. The findings echo ESET’s earlier investigation of Middle Eastern watering-hole campaigns that profiled visitors before selectively redirecting them toward suspected browser exploits; ESET assessed with medium confidence that those operators were Candiru customers. Limited visibility remains a major detection obstacle, with Al Jazeera network logs providing essential evidence for one attack. Defenders should prioritize browser and mobile patching, scrutinize advertising-origin script activity, and assess exposure of readable session cookies.
TTPs, infrastructure, and targeting history in one profile.
28 events from the most recent confirmed update back to the earliest known activity.
The domains tracookiepixel[.]xyz and cookie-sync[.]xyz were suspended. Confiant noted that cookie-sync[.]xyz had not appeared active during its observation period.
Belgium experienced a combined Android and iOS advertising surge from July 21 through July 27. Separately, Belgium accounted for 56% of observed Candiru-attributed handoffs in Confiant's dataset.
Confiant observed a Windows-only spike in Discover-Tech advertising in Gibraltar, reaching 4.7% of observed ads.
An advertisement triggered Confiant's client-side cloaking heuristics and led to infrastructure attributed to Candiru through Citizen Lab's high-confidence findings. Confiant's investigation covered Discover-Tech activity from April 1 through September 10, 2026.
Discover-Tech advertisements reached a daily peak of 9.9% of observed ads in Palestine. Palestine had the operator's highest relative reach in Confiant's dataset.
Publicly exposed bidding records showed Discover-Tech-linked advertisements containing attacker script tags across more than 70,000 mobile apps and 120,000 websites between March and June 2026. Researchers cautioned that not all Discover-Tech advertisements were necessarily weaponized.
Confiant observed a Discover-Tech-injected payload using a /?qq= endpoint, encrypted WebSocket communications, device checks, and AES-encrypted JavaScript execution. It contained a misleading Google copyright comment resembling a decoy documented in ESET's Candiru research.
ESET reported that the second wave lasted until August 2021, after which compromised websites were cleaned again. Researchers were unable to retrieve the final exploit or payload.
The second-wave infrastructure switched to FingerprintJS Pro for extensive browser and device profiling with encrypted communications. The infrastructure could return JavaScript for execution in the current page.
The United States government placed Israeli spyware vendor Candiru, which has also used the name Integrity Labs, on its Entity List.
A second wave began, affecting Yemeni government and media websites, Syrian sites, Lebanese broadcasters, and South African Denel-related domains. Attackers modified existing website scripts and used cookie-based suppression to limit repeated malicious injections.
ESET detected that the Iranian embassy website in Abu Dhabi had been modified to inject JavaScript from piwiks[.]com. Other known compromised sites in the first wave included Middle East Eye, Piaggio Aerospace, and Lebanese outlet Al-Manar.
ESET assessed that strategic web compromises began when middleeasteye.net started injecting code from piwiks[.]com. The campaign profiled visitors and attempted to redirect selected Windows and macOS users toward a suspected browser exploit chain.
The piwiks[.]com domain was re-registered, marking the earliest campaign activity ESET traced. Attackers subsequently used it to deliver malicious JavaScript through compromised websites.
ESET researchers built an internal system to detect strategic web compromises on high-profile websites. The system later helped uncover Candiru-linked activity targeting visitors to Middle Eastern websites.
The reported Discover-Tech-linked spyware operation also targeted media organizations in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden, alongside international media-service networks. The reference does not establish successful infections at these additional organizations.
Researchers reported that a separate threat actor, Dark Cartographer, uses Discover-Tech's software and exploits mobile-carrier vulnerabilities to associate device advertising identifiers with phone numbers, facilitating mass deanonymization.
Google terminated Discover-Tech's access to its advertising exchanges and removed it from approved vendor lists; IAB Europe also removed the company from its approved vendor list. Beeswax, Vungle, and Eskimi took unspecified actions against Discover-Tech following the findings.
Citizen Lab found that spyware vendors Bindecy and Candiru used Discover-Tech's Controlium advertising platform to target people. Publicly accessible login records included details belonging to Bindecy employees and at least two Candiru employees.
Investigators recovered a Windows DLL from a compromised device and attributed it to Candiru with high confidence. The component used COM hijacking for persistence, a repeating 48-byte XOR method to conceal strings, and two command-and-control domains.
Citizen Lab reported spyware infections at Al Jazeera and identified zero-click attacks targeting at least 45 of the outlet's devices. Researchers linked the attacks with high confidence to Candiru spyware delivered through Discover-Tech advertisements, but could not attribute them to a specific operating party.
Confiant identified organizational and technical connections through public code repositories, passive DNS, shared AWS certificates, and a shared Wix account identifier. These findings linked Discover-Tech and MyIPInfo to Intelos, Adtimizer, and Tekma.
Researchers observed Discover-Tech advertisements on government, military, critical infrastructure, NATO, and United Nations networks. Confiant cautioned that this advertising reach did not establish deliberate targeting or compromise, and most observed Candiru-linked impressions reached residential or mobile connections.
Confiant observed Discover-Tech collecting readable first-party cookie jars across more than 1,000 publisher domains, including authenticated session identifiers and sometimes email addresses and names. Some collection occurred in EU scenarios without consent for GDPR-covered processing.
Confiant documented hidden advertising iframes that loaded an obfuscated SDK capable of encrypted command-and-control, device fingerprinting, behavioral monitoring, and operator-supplied JavaScript execution. Researchers did not capture a complete exploit chain or demonstrate a browser sandbox escape.
Citizen Lab identified Discover-Tech as the operator of Controlium, an advertising platform it said could de-anonymize, fingerprint, and automatically infect devices when an advertisement appears. Researchers estimated that millions of devices had been directed to Candiru servers for potential profiling.
ESET linked the activity to the cluster Kaspersky tracks as Karkadann and assessed with medium confidence that the operators were Candiru customers. Its investigation documented selective visitor profiling and suspected browser exploitation rather than recovery of a complete exploit chain.
The first wave ended in late July or early August 2020 when malicious code was removed from compromised websites. ESET assessed that the attackers likely performed the cleanup.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 103 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
13 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcearstechnica.com
Open sourcereddit.com
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourcecyberscoop.com
Open sourcewelivesecurity.com
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab reported that at least 45 Al Jazeera devices were targeted in 2024 and 2025 through online advertisements linked with high confidence to Israeli spyware maker Candiru. The reported zero-click attacks required no user interaction: advertisements collected device identifiers, while backend servers selectively delivered attack code to targeted devices. Researchers recovered spyware from one compromised device but did not recover the initial browser or application exploit, leaving the initial exploitation stage inferred from infrastructure and traffic evidence. Discover-Tech supplied the advertisements, and several advertising platforms subsequently removed or restricted its access. The advertising infrastructure reached approximately 75,000 mobile applications and 120,000 websites, including sensitive institutional networks, but **advertisement exposure does not establish infection**. The findings extend earlier reporting on Candiru’s operations: Recorded Future’s Insikt Group identified eight associated infrastructure clusters, five assessed as highly likely active as of June 2025, while noting unresolved questions about advertising-based infection and current mobile capabilities. Its report documented Candiru’s DevilsTongue Windows spyware capabilities, including credential theft, file extraction, message access, and session impersonation; those capabilities should not automatically be attributed to the Al Jazeera compromise. For organizations facing mercenary-spyware threats, recommended defenses include timely software updates, indicator hunting, device separation for high-risk activity, and travel-focused security briefings.
Oct 16, 2026
Citizen Lab and Microsoft exposed **Candiru**, an Israel-based mercenary spyware vendor also known as **Saito Tech Ltd.**, after investigators recovered a Windows malware sample dubbed **DevilsTongue** from a politically active victim in Western Europe. The investigation tied Candiru to a large surveillance operation that used more than **750 spoofed domains** masquerading as media outlets, advocacy groups, international organizations, and technology brands to lure targets and support spyware delivery. Microsoft said the operation exploited two Windows privilege-escalation zero-days, **`CVE-2021-31979`** and **`CVE-2021-33771`**, which it patched as part of its response. Researchers and Microsoft linked the activity to at least **100 victims** across countries including Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia, and Singapore, with journalists, dissidents, activists, politicians, and human rights defenders among those targeted; the infrastructure was also connected to the **CHAINSHOT** exploit kit and earlier Chrome and Microsoft Office zero-day exploitation.
Aug 15, 2026
A malvertising campaign traced to at least October 2016 targeted millions of visitors to popular news websites with advertisements that concealed malicious JavaScript in image transparency values. ESET subsequently identified the activity as a new wave of **AdGholas**, which had switched from Angler and Neutrino to the **Stegano exploit kit**, also known as Astrum. The infection chain used an Internet Explorer vulnerability to check the victim’s environment and three Flash vulnerabilities to compromise susceptible systems without requiring user interaction. The campaign employed multiple anti-analysis checks, encrypted communications, and payloads disguised as GIF images to evade detection. Observed payloads contained or downloaded **Ursnif and Ramnit**, exposing victims to credential theft, surveillance, banking fraud, and further compromise. The attack demonstrated that visiting a legitimate website could trigger infection through third-party advertising; eliminating legacy Internet Explorer and Flash exposure and restricting untrusted advertising content are key defensive measures against this attack pattern.
Oct 9, 2026