New Security Threat: Candiru Spyware Spreads via Web Ads

A disturbing new development has emerged in the world of digital security. A report from Citizen Lab, a research group at the University of Toronto, reveals that spyware from the Israeli company Candiru—now known as Integrity Labs—is infiltrating devices through online advertisements. This marks the first confirmed use of a zero-click method via advertising, meaning users do not need to click on anything; the infection begins the moment a webpage loads.

How the attack works

The malicious campaign is orchestrated by the Israeli advertising firm Discover-Tech. While officially operating as an ad placement agency, the company has been exposed as an intermediary for spyware distributors. The attack exploits "real-time bidding," the split-second automated process that determines which advertisement appears on your screen when you open a website or app.

When a Discover-Tech ad loads, a specialized script checks the user's device ID and IP address. If the device matches a pre-determined "target list," the script automatically executes malicious code. For all other users, the ad appears normal, making the malicious activity extremely difficult to detect. This method was used to target over 45 devices belonging to Al Jazeera staff between 2024 and 2025.

Global scale and response

The study analyzed records from four billion advertising auctions. It found that between March and June 2026, Discover-Tech ads appeared on over 70,000 apps and 120,000 websites. Malicious ads were detected within high-profile networks, including NATO, the U.S. Department of Defense, and the International Atomic Energy Agency, though there is currently no direct evidence that these specific entities were infected.

Following the disclosure, Google and IAB Europe removed Discover-Tech from their lists of trusted partners. Additionally, Beeswax, Vungle, and Eskimi have terminated their cooperation with the firm. Although Candiru has been on the U.S. "blacklist" since 2021, such companies continue to find ways to sustain their operations.

What this means for users

This case confirms that modern spyware technology is becoming increasingly sophisticated, and anyone can become a victim regardless of how cautious they are online. While information regarding large-scale attacks of this nature in Georgia is limited, it is recommended that users follow modern security standards, download regular software updates, and use trusted browsers capable of blocking malicious scripts.