Citizen Lab Traces Discover-Tech Ads to Candiru Zero-Click Payloads on NATO and UN Networks

Discover-Tech, an Israeli firm previously listed as certified by Google and IAB Europe, abused GDPR consent flows and major ad exchanges to profile and serve malicious impressions. Targets matching profiles supplied by Candiru customers received ads that connected to control servers and executed zero-click payloads. The campaign produced impressions on NATO, United Nations, European parliamentary, Australian critical infrastructure, and Norwegian and Swedish defense networks.

Citizen Lab documented removal actions after publication: Google terminated Discover-Tech access to its exchange and ad vendor registry, IAB Europe revoked certification, Beeswax blocked accounts, and Vungle paused service. No specific CVEs or final malware binaries were disclosed; the report states the exploits were likely zero-days subsequently patched. Ad impressions continued until platform-level blocks took effect.

The operation demonstrates structural verification gaps in real-time bidding systems that permit mercenary spyware vendors to reach high-value endpoints without user interaction. Use of legitimate consent frameworks and verified vendor status allowed traffic to evade automated detection while delivering code to mobile and desktop browsers on sensitive networks.

Platforms have begun tightening vendor onboarding and impression monitoring. User-level mitigations remain limited to ad blockers, advertising ID resets, and network-level filtering. No timeline for industry-wide protocol changes has been published.