TLDR
An Israeli ad-tech firm called Discover-Tech embedded Candiru spyware in programmatic display ads that infected devices at render time, requiring no click. Its ads appeared on Australian government, power-grid and research networks, including the Australian Nuclear Science and Technology Organisation (ANSTO) and the Australian Synchrotron. Google and IAB Europe had listed the firm as an approved vendor since 2020 and removed it in October 2026.
KEY TAKEAWAYS
Discover-Tech ads delivered spyware
The attack needed nothing from its target. When a device rendered a Discover-Tech ad, malicious JavaScript inside the creative connected silently to a Discover-Tech server, checked whether the device matched a pre-selected profile, and if it did, handed it to Candiru's spyware infrastructure.[1] Citizen Lab named this mechanism AdFection. A simple display of a targeted Discover-Tech ad was sufficient to deliver spyware without any user interaction.[1]
The firm ran its operation through a demand-side platform (DSP) called MyDSP, the software layer that bids for ad inventory on a buyer's behalf in real-time auctions. Every time a user loaded a page or opened an app, MyDSP could bid for the right to show that person an ad, and with it, potentially execute code on their device.
The scale of the operation
Between March and June 2026, MyDSP bid on 3,770,286,576 impressions and won 441,954,291 auctions, an 11.7 per cent win rate.[1] Ads carrying the attacker script ran across 75,373 apps and 120,768 websites.[1]
Yandex supplied 67.4 per cent of the upstream inventory, Google Ad Manager 24.74 per cent, and Vungle (now Liftoff) the remaining 7.24 per cent.[1]
| Metric | Figure |
|---|---|
| Total bids placed | 3,770,286,576 |
| Auctions won | 441,954,291 (11.7%) |
| Apps carrying malicious ads | 75,373 |
| Websites carrying malicious ads | 120,768 |
Where the ads landed in Australia
Citizen Lab found "a substantial cluster of impressions in Australia", on government and private-sector networks, networks linked to grid and power companies, and university and research networks, including the Australian Synchrotron and the Australian Nuclear Science and Technology Organisation (ANSTO).[1] Ads also appeared on the networks of three Australian media organisations, which the report did not name.[2] An ad appearing on a network does not show that anyone there was targeted or infected, Citizen Lab said.[2]
ANSTO told iTnews it was following standard response processes and had found no impact.[2] It did not say whether it blocks ads on staff devices or its network.[2]
The campaign follows Citizen Lab's 2024 and 2025 documentation of Candiru spyware reaching Qatari broadcaster Al Jazeera through the same infrastructure, where at least 45 devices were targeted.[1]
Six years on Google's certified list
Discover-Tech appeared on lists of "certified" and "approved" ad vendors kept by Google and IAB Europe from 2020 until 2026.[1] Google and IAB Europe removed Discover-Tech from their registries in early October 2026; Beeswax removed the company and Liftoff paused its access around the same time.[1]
Confiant, a New York ad security firm, published a parallel report linking the ads to Candiru.[2] Jerome Dangu of Confiant said: "The industry has optimized against cyber criminals, scams and malware for profit."[3]
Wolfie Christl, a senior researcher at Citizen Lab, called it "disastrous" that ad vendors did not detect the operation for years. "Digital advertising is broken," he said.[3]
Checks for Australian media buyers
Citizen Lab recommended that governments mandate ad blocking and disable advertising IDs on all official devices.[1] In Australia that advice is not new: the Australian Signals Directorate's Essential Eight already requires browsers not to display internet ads.[2]
For agencies and publishers, the uncomfortable part is the paperwork. Discover-Tech sat on the same approved-vendor lists that buyers and sellers lean on as a sign a DSP can be trusted, and it bought through the same exchanges as everyone else. Citizen Lab says its data covers only part of the firm's activity over a limited period, so the full reach in Australia is still unknown.[1]
SOURCES & CITATIONS
Xaviery Malinao writes for Prompt the Market on how brands and agencies are adapting to answer engines, drawing on Bushnote's work with clients across search, AI search and content.
