Discover-Tech: How an AdTech Company Became a Spyware Targeting Infrastructure

What is Discover-Tech?

Discover-Tech is an Israeli advertising technology company that Citizen Lab identified as the central enabler of the AdFection spyware delivery campaign. Citizen Lab describes Discover-Tech as acting as a bridge between the normal advertising industry and multiple mercenary surveillance companies, including Candiru. Its surveillance-oriented platform, called Controlium, provided the targeting and delivery infrastructure that allowed operators to identify specific individuals through advertising identifiers and deliver code to their devices.

The company's position in the advertising ecosystem is operationally significant. As an adtech company, Discover-Tech had legitimate access to the programmatic advertising infrastructure that reaches hundreds of thousands of apps and websites. This access, when combined with the Controlium targeting platform, gave the operation an enormous attack surface from which individual targets could be selected.

Citizen Lab obtained nearly four billion advertising-bid records exposed by Discover-Tech, covering approximately March to June 2026. Their advertisements were displayed across 75,373 Android and iOS apps and 120,768 websites, nearly 200,000 apps and sites in total. This scale is what made the AdFection delivery method possible.

Controlium: the targeting platform

Controlium is the surveillance-oriented platform that Discover-Tech operated. Citizen Lab reconstructed much of Controlium's interface from publicly accessible frontend code. The platform contained functionality for campaign creation, target lists, mobile advertising IDs, IP targeting, ad impressions, recent bid requests, browser identifiers, device information, and configurable URL and script delivery.

From an offensive perspective, Controlium's core value is its ability to upload target identifiers for individual people and associate those identifiers with advertising campaigns. The supported targeting selectors include mobile advertising IDs, browser and ad-network identifiers, IP addresses, device characteristics, and geographic information. This means an operator can target a specific person without knowing which website or app they will use next.

The platform also supported Android and Apple mobile advertising identifiers specifically, which means the targeting capability extended to mobile devices. However, Citizen Lab has not publicly provided a recovered iOS or Android Candiru implant from this campaign, so mobile compromise through AdFection remains demonstrated at the targeting level but not at the implant level.

The URL delivery system: Controlium's offensive engine

One of the most operationally significant findings in Citizen Lab's report is Controlium's campaign URL delivery mechanism. The platform allowed URL types including Ad URL, Test URL, Script, User Agent, Monitor, Pixel, and De-anon. Each of these types serves a different offensive purpose.

The Script type is particularly significant. Citizen Lab believes it may allow arbitrary JavaScript to be delivered to selected targets. When combined with browser exploitation, this is an extremely powerful capability because it means the operator can deliver custom code to a specific device through the advertising infrastructure without the target ever clicking anything.

The De-anon type points to de-anonymization functionality, which would allow the operator to associate advertising identifiers with real-world identities. This is the capability that bridges the gap between ADINT, the collection of advertising-derived intelligence, and targeted exploitation. The operator can identify a person through advertising, confirm their identity through de-anonymization, and then deliver the attack through the Script URL type.

How Discover-Tech evaded advertising security scanners

The offensive effectiveness of Discover-Tech's infrastructure depended heavily on selective execution. Non-targeted users frequently received no additional malicious JavaScript when the ad loaded. This selective response meant that automated advertising-security scanners, which inspect creatives automatically, saw something different from what the actual target saw.

Eskimi, an advertising platform that separately investigated Discover-Tech, confirmed that creatives returned different code depending on factors including device, IP address, and location. Eskimi reported that campaigns sometimes targeted extremely narrow IP ranges, which further reduced the likelihood that security scanners would trigger on the malicious variant.

Confiant's parallel investigation documented code capable of harvesting extensive browser and device signals, including mouse movement, clicks, keyboard timing, scrolling, touch events, navigation behavior, and visibility state. In some advertising contexts, the code was capable of reading accessible first-party cookies, including session identifiers and identity-related information. This fingerprinting and cookie-reading capability is what enables the targeting system to recognize and validate specific devices.

Discover-Tech's infrastructure and domain families

Citizen Lab identified several Discover-Tech-related domain families useful for threat hunting. These include discover-tech[.]io, mtrtb[.]com, mydsp[.]io, controlium[.]net, powerium[.]net, platc-tester[.]com, myweb3id[.]io, myipinfo[.]io, akedo[.]gg, and volasim[.]com. Eskimi separately identified suspicious loaders including dtech.adtimizer[.]co and several mtrtb[.]com loader subdomains.

These domains should be treated as historical research indicators rather than blindly blocked without context. The operator's infrastructure is designed to be rotated, and blocking entire domain families without understanding the specific campaign context can create false positives and alert fatigue.

Following the October 2026 disclosure, Google terminated Discover-Tech's access to its advertising exchanges and deployed Safe Browsing protection against known actor-controlled domains. IAB Europe suspended Discover-Tech, and several advertising platforms including Beeswax, Vungle/Liftoff, and Eskimi cut off the company's access. However, the architecture is replicable, and enforcement against one operator does not remove the underlying attack surface.

Frequently asked questions

Related research