Candiru Zero-Click Infections Routed Through Discover-Tech Ad Platform to 45 Al Jazeera Devices

Citizen Lab examined four billion ad placement records and mapped malicious JavaScript execution that deanonymized targets then triggered Candiru infection without user interaction. Confiant's telemetry confirmed the same infrastructure reached internal segments of the International Criminal Court and multiple national-security networks. The ads avoided direct payload sharing with Google and Yandex while still executing reconnaissance and fingerprinting on millions of devices.

The operational pattern shows ad-tech intermediaries now function as the new delivery layer for mercenary spyware, bypassing export controls and social-engineering requirements that previously limited Candiru sales. Discover-Tech's contracts with multiple Israeli firms indicate the bridge role is structural rather than incidental. Earlier ad-tech abuse reports lacked the scale and attribution detail now documented.

Google, Yandex and major DSPs blocked Discover-Tech post-publication, yet Controlium-style infrastructure can migrate to new entities within weeks. Regulators have not imposed ad-platform KYC rules equivalent to those applied to spyware vendors themselves.

Next indicators to watch are fresh contract awards or domain registrations tied to the same infrastructure fingerprint within 120 days.