Key facts
- Discover-Tech delivered zero-click exploits via targeted ads to install mercenary spyware.
- The malware was developed and distributed by Candiru, also known as Integrity Labs.
- Ads contained code that connected to Candiru's control servers, delivering exploits.
- Discover-Tech's ads appeared on NATO, UN, and critical infrastructure networks.
- Google, IAB Europe, Beeswax, and Eskimi have taken action against Discover-Tech.
Discover-Tech, an ad vendor, utilized targeted advertisements to deliver zero-click exploits, enabling the installation of mercenary spyware, according to a report by Citizen Lab. The exploits were delivered through ads containing code that connected to Candiru's (Integrity Labs) control servers. These ads appeared on networks linked to governments and national security, including NATO and United Nations systems, as well as critical infrastructure providers and armed forces in Australia, Norway, and Sweden. In response to the findings, Google and IAB Europe have removed Discover-Tech from their respective ad vendor registries, with Google also terminating the firm's access to its ad exchange platforms. Beeswax has removed Discover-Tech from its platform, while Vungle (Liftoff) has paused access pending a review, and Eskimi has blocked Discover-Tech's accounts.