The Israeli company Discover-Tech has developed a new spyware delivery technique called “AdFection”, used to infect devices without requiring any interaction from the victim to install it.
This is according to research by the University of Toronto’s Citizen Lab and the US cyber-security company Confiant, the Financial Times reports.
According to the report, the technology turns a system that processes trillions of online advertising transactions every day into a covert surveillance tool, allowing attackers to identify targets and compromise their devices.
Targeted online advertising works through an automated auction system in which advertisers can buy the right to show an advert to a specific internet user. This process is managed by ad exchanges run by companies such as Google, which send bid requests to potential advertisers. The request contains anonymised information about the user, such as their approximate location, IP address and browsing history. Normally, companies use this data to personalise advertising. However, the report says Discover-Tech’s software uses the same information to build a profile and de-anonymise the user. If a user is identified as a target, malicious code hidden inside an advert is sent to their device, leading to infection.
The software does not require any interaction from the victim to be installed. This sets it apart from traditional spyware, which typically requires a person either to click a malicious link or download an infected file.
According to new research by Citizen Lab, Discover-Tech’s platform was used in attacks on journalists and Al Jazeera staff in 2024 and 2025, infecting at least 45 devices with commercial spyware developed by another Israeli company, Candiru. Data analysed by researchers indicates the platform may also have been used to distribute spyware from other Israeli companies.
According to the report, Discover-Tech’s adverts were shown on more than 120,000 websites — including the BBC and The New York Times news sites — and in more than 70,000 mobile apps, including Yahoo Mail and Duolingo, as well as the dating apps Badoo and Grindr.
The research also found that Discover-Tech adverts were delivered to the devices of employees of the US defence contractor Raytheon, as well as semiconductor companies Nvidia, Sandisk and Arm; officials and staff at NATO and the European Commission; law-enforcement personnel; and critical infrastructure facilities in Norway, Sweden and Denmark.
Discover-Tech was registered as a certified advertising supplier with Google and the Brussels-based industry association IAB Europe.
“Following a joint investigation with Citizen Lab and Confiant, Google has blocked Discover-Tech on our advertising platforms for systematic violations of our policies,” Google said in a statement to the Financial Times. IAB said it had suspended the company’s membership in its global vendor list pending further investigation.