A new investigation by the University of Toronto’s Citizen Lab has found that an account primarily accessed from India was among the users of Controlium, a platform operated by Israeli advertising technology company Discover-Tech that researchers say could be used to profile individuals and deliver mercenary spyware through targeted advertisements.
Citizen Lab said the account, identified as “mi19mos25a”, logged in mainly from India and occasionally from Israel. However, the researchers could not identify the entity behind the account or establish what campaigns it had configured.
The investigation also identified a separate India-linked corporate connection. Affle, an Indian-listed mobile advertising company now known as Affle 3i Limited, acquired certain business assets from Discover-Tech in 2021 through a Dubai-based subsidiary. Citizen Lab said it had no reason to believe that Affle controlled Discover-Tech’s malicious advertising operations and noted that the exact scope of the asset sale remained unclear.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
India-Linked Account Found on Controlium Platform
Citizen Lab said it extracted login records covering 128 days and identified 120 distinct usernames that had accessed Controlium.
Among them was the account “mi19mos25a”, which the researchers said had logged in primarily from India and occasionally from Israel. The investigation did not identify who operated the account or determine whether it had been involved in any specific spyware campaign.
Controlium was described by Citizen Lab as a platform that allowed customers to select individual users for profiling or potential infection through targeted advertising.
The researchers said the system could help operators identify and de-anonymise users, fingerprint their devices and potentially deliver code when targeted advertisements were displayed.
Separately, company filings show that Affle’s Dubai-based subsidiary, Affle MEA FZ-LLC, acquired business assets from Discover-Tech in 2021. The transaction included technology, intellectual property, business relationships, technical information and the Discover-Tech brand name.
The fixed consideration was $1.15 million, with a possible additional success fee of up to $3.37 million over four years.
Citizen Lab said the available evidence did not indicate that Affle controlled the malicious advertising operations examined in its investigation.
Al Jazeera Devices Targeted Through Advertising System
Citizen Lab said Discover-Tech’s infrastructure had facilitated the delivery of Candiru spyware to devices at Al Jazeera in 2024 and 2025.
Researchers said at least 45 devices within the news organisation were targeted and infected through the advertising system.
The technique was described as “AdFection”, which Citizen Lab called the first publicly confirmed case of zero-click mercenary spyware being delivered through targeted advertisements.
Unlike conventional phishing attacks, a zero-click method does not require a user to open a malicious link, download a file or interact with an advertisement.
According to Citizen Lab, displaying a targeted advertisement could be sufficient for a device to connect to an operator-controlled server, allowing it to be profiled and, if selected, potentially infected.
The investigation began after Al Jazeera’s internal technical team noticed unusual network activity in 2024, with similar patterns continuing into 2025.
After receiving network logs from the organisation, Citizen Lab traced connections from Discover-Tech’s advertising infrastructure to a Candiru validation server and then to a command-and-control server. The researchers linked the activity to Candiru spyware with high confidence.
Citizen Lab described Discover-Tech as a bridge between advertising vendors and the mercenary spyware ecosystem.
Billions of Ad Bids Examined Across Global Networks
Citizen Lab analysed nearly four billion advertising-bidding records that had been made publicly accessible on a Discover-Tech website.
Between March and June 2026, the company’s MyDSP platform reportedly bid on approximately 3.77 billion advertising impressions and won around 442 million.
Researchers found that approximately 718.7 million bids, or about 19%, related to advertisements that appeared to contain scripts pointing to a server used in the spyware delivery mechanism.
Advertisements carrying those scripts were displayed in 75,373 Android and iOS applications and on 120,768 websites.
More than one million such advertisements reportedly appeared on each of MX Player and Lark Player. Viber displayed more than 700,000 on Android, while Snap VPN, Truecaller and VivaCut each showed around half a million. Ludo STAR was also among the applications where the advertisements appeared.
Citizen Lab stressed that the appearance of an advertisement on a device or institutional network did not, by itself, establish that a particular person had been selected for infection.
A complementary investigation by advertising-security company Confiant found Discover-Tech advertisements in 228 countries and estimated that the operation served about 10 million advertising impressions a day.
Citizen Lab also found that Discover-Tech had appeared on lists of certified or approved advertising vendors maintained by Google and IAB Europe between 2020 and 2026.
Following the investigation, Google terminated Discover-Tech’s access to its advertising-exchange platforms in early October 2026. IAB Europe suspended the company from its vendor registry, while other advertising platforms also restricted or reviewed its access.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
