Israeli Ad Platform Discover‑Tech Uncovered as Delivery Route for Candiru Zero‑Click Spyware

Security researchers have identified Israel-based advertising technology firm Discover‑Tech as a covert distribution channel for the sophisticated Candiru spyware, enabling attackers to infiltrate targeted devices without any user interaction.

Candiru, a commercially sold surveillance tool known for its zero‑click exploit capabilities, has been linked to high‑profile espionage operations worldwide. Unlike conventional malware that relies on phishing emails or malicious links, zero‑click exploits can compromise a device simply by sending a specially crafted data packet, making detection and prevention exceptionally difficult.

The investigation revealed that malicious actors hijacked Discover‑Tech's ad delivery infrastructure to embed tracking scripts within legitimate‑looking advertisements. These scripts first fingerprint the visitor’s device—collecting information such as operating system version, hardware identifiers, and network characteristics—before relaying the data to a command server. Once a high‑value target is identified, the same channel can push the Candiru payload directly onto the device, bypassing the need for the user to click or download anything.

Using a mainstream advertising network for such purposes blurs the line between normal web traffic and hostile activity, complicating efforts by security teams to spot anomalies. The incident underscores growing concerns about the security of the online advertising supply chain, where countless third‑party scripts are routinely loaded on web pages. It also raises questions about oversight of firms that operate in the lucrative ad‑tech sector, especially when they originate from countries with strong cybersecurity industries.

Following the disclosure, security firms have alerted potential victims and are working with Discover‑Tech to remediate the compromised ad placements. Industry observers are calling for tighter vetting of ad‑tech providers and the adoption of stricter standards for code integrity. As investigations continue, the case serves as a reminder that even reputable infrastructure can be repurposed for espionage, highlighting the need for continuous monitoring and collaboration between advertisers, publishers, and security researchers.