Ad-tech company was a delivery system for "mercenary spyware"

An Israeli ad‑tech firm called Discover‑Tech turned programmatic advertising into a delivery pipeline for mercenary spyware by using the ad ecosystem’s persistent user identifiers and approved supplier status to find and infect individual targets. By participating in billions of ad auctions on major platforms, the firm could match identities, serve arbitrary ad code, and deploy zero‑click, zero‑day exploits that took over devices without user interaction. The campaign included malicious GDPR‑style notices to trick victims, attacks on Al Jazeera staff using Candiru malware, and operational ties to known Israeli cyber‑mercenary actors and NSO‑linked personnel. Discover‑Tech was certified by major industry players and ran malicious creatives across hundreds of thousands of sites and apps, giving it access to more than four billion bidding opportunities to locate and compromise targets.

The episode demonstrates that surveillance‑based ad infrastructure is not merely privacy invasive but actively dangerous: the industry’s persistent identifiers, weak vetting, and incentive structure let mercenaries weaponize advertising at scale. Targeted ads yield only marginal performance gains (under 5% CTR improvement versus contextual ads) while concentrating power in spying intermediaries that underinvest in security and collude to extract rents. The practical remedies are to block programmatic ads, outlaw surveillance advertising in favor of contextual targeting, and resist “pay or okay” coercion that monetizes users’ privacy, because privacy and basic device safety should not be luxury options.