Discover-Tech: Technical Profile of the AdTech Infrastructure Behind AdFection

Company background

Discover-Tech is an advertising-technology company identified in Citizen Lab's October 2026 AdFection report as operating infrastructure that participated in the ad-delivery path linking programmatic advertising to Candiru spyware[1]. The report reconstructs how Discover-Tech's ad-buying and targeting infrastructure was positioned to deliver target-conditioned code through normal ad rendering.

Place in programmatic advertising

Discover-Tech's infrastructure sits within the programmatic advertising supply chain: it participates in real-time bidding auctions, receives bid requests containing device metadata, and delivers ad creatives that may contain references to remote script endpoints. The reported scale of exposure is substantial — Citizen Lab analyzed approximately 3.77 billion publicly exposed advertising bidding records (March–June 2026), reporting that Discover-Tech won roughly 442 million impressions (~11.7% of auctions) across 161 countries by IP geolocation, and that ads containing attacker-related script tags were displayed through 75,373 Android/iOS applications and 120,768 websites. Reach extended into sensitive networks including NATO, the UN, EU institutions, defense ministries, critical infrastructure, and major technology and media firms[1,7].

Known historical platforms

Certifications, exchanges & consent

Discover-Tech had been listed as a certified or approved vendor by Google and IAB Europe, and operated through major ad exchanges including Google, Yandex, and Beeswax. It also leveraged GDPR consent frameworks, which lent its ad delivery an appearance of regulatory legitimacy[1,7].

Named individuals & corporate links

Public reporting identified CEO Dekel Boni, who has an ad-tech background. Board and shareholder links included Eric Banoun (associated with Circles, Senpai Technologies, and the Intellexa orbit) and entities tied to Sara Hamou (linked to Intellexa)[1]. These links are reported findings; this site labels confidence accordingly.

Controlium

Controlium is the targeting platform associated with Discover-Tech that researchers reconstructed. It supports targeting based on mobile advertising identifiers, browser cookie identifiers, and IP addresses, and integrates with NOAS/getAd for selective code delivery. See the Controlium pillar.

Connection to Candiru / Integrity Labs

The Citizen Lab report links Discover-Tech's advertising infrastructure to Candiru validator and C2 infrastructure through the documented temporal pattern: Discover-Tech contact → Candiru validator → profiling/infection → Candiru C2[1]. Connections reported in research to entities such as Bindecy and Intelos, and the DARK CARTOGRAPHER findings, are noted with the caveat that further Citizen Lab reporting was announced.

2026 enforcement & platform responses

Following coordinated disclosure with Confiant in early October 2026, Google removed Discover-Tech from its ad platforms and vendor lists, IAB Europe suspended it, and Beeswax terminated access. Other platforms including Vungle/Liftoff and Eskimi paused or blocked accounts and domains[1,7]. Further responses are tracked in our latest intelligence section.

Infrastructure indicators

Defensive domains reported in the research include families associated with the parent domains below. These are historical defensive research indicators; this site does not imply that every hostname under every parent domain is malicious.

Full searchable database on the IOC database.