Discover-Tech Ad Platform Delivered Candiru Zero-Click Infections to 45 Al Jazeera Devices

Discover-Tech purchased ad inventory via standard RTB auctions and injected JavaScript that submitted advertising IDs to its servers, then served Candiru payloads based on IP and identifier matches. The exposed bid database contained four billion records showing ads on nearly 200,000 domains and apps. Citizen Lab traced 45 confirmed infections inside Al Jazeera directly to this channel, confirming the firm operated as a mercenary delivery intermediary rather than a conventional advertiser.

The technical evidence shows Discover-Tech maintained persistent connections to multiple surveillance vendors beyond Candiru, including Dark Cartographer's mobile identifier-to-phone-number linkage operations. This pattern reveals ad exchanges as scalable deanonymization infrastructure that bypasses endpoint protections without requiring user interaction or phishing. Google, IAB Europe, Beeswax, and Eskimi removed the firm after the report, yet the underlying RTB data flows remain unchanged.

Everyday advertising services now function as persistent attack surfaces for state-linked actors. The same identifiers used for legitimate tracking enable precise targeting at global scale. Blocking targeted ads at network gateways is the only immediate mitigation until ad exchanges enforce verifiable payload inspection.

Next steps include tracing Discover-Tech's remaining infrastructure and monitoring for rebranded operations under new ad vendor registrations within the next quarter.