The Maze: Google has cut off an Israeli advertising intermediary after research connected its ads to spyware, software that secretly monitors devices. The case concerns Discover-Tech and historical attacks on Al Jazeera, an international news network. For advertising buyers and publishers worldwide, it exposes a gap between approving a vendor and controlling the code its ads deliver.
Source: The Citizen Lab. Original research diagram showing advertisers, ad buying and selling platforms, the exchange, publishers and viewers.
The Details:
The removal follows a newly public investigation. Google stopped Discover-Tech from bidding or serving through its ad exchanges, the systems that auction advertising space. Google and advertising industry association IAB Europe also removed it from vendor registries in early October. Discover-Tech had appeared on their lists since 2020. The Citizen Lab, a University of Toronto research group, published its technical investigation on October 15. Researchers linked attacks targeting at least 45 Al Jazeera devices in 2024–25 to Candiru spyware with high confidence. That is a research assessment, and 45 counts targets rather than confirmed infections of every device. The disclosure is new; the attacks described are historical.
An ad can deliver more than its picture. Automated auctions let buyers compete to show an ad to a particular device. Ads can also run code. Displaying Discover-Tech’s ads made them request further instructions from its server, which selected responses using information about the viewer. Someone outside the selected group usually received nothing. No click was needed for the documented spyware delivery. Advertising platform Eskimi said this changing behavior helped the ad code evade external scanning. Confiant, an advertising-security company conducting a parallel investigation, found checks on device characteristics and a mechanism for running further instructions inside the ad. It did not capture a complete exploit chain in the wild. The researchers’ findings therefore support a targeted delivery mechanism, without establishing that every encounter caused infection.
The publisher’s setup changes what an ad can read. Confiant also observed collection of cookies, data saved in a browser, in ad sessions across more than 1,000 publisher domains. Some contained identifiers for active signed-in sessions. An ad kept in a separate browser compartment exposed little or nothing in its observations. An ad running with the publisher page’s permissions could read much more. This is a separate concern from installing spyware: unwanted data collection can happen without proving a successful device break-in. The report does not establish that every collected session identifier enabled account access.
MarketMaze Take: Vendor approval and ad safety are different operating questions. A registry identifies an accepted participant. An ad-content scan inspects what its test viewer receives. A publisher also needs to understand what that participant’s code can do when a real visitor arrives. This case makes those distinctions commercially relevant across markets.
A clean scan has a viewing condition. If a server changes its response by device or location, testing one version cannot establish what every visitor receives. Buyers and publishers assessing assurance claims need to know which behavior was tested. That follows from this delivery method; it is not proof all verification services fail.
Isolation limits a different exposure. Confiant’s contrast between separated ads and ads with page-level access shows why publishers should examine ad execution permissions alongside vendor checks. Better identification of the buyer and tighter access to browser data address different weaknesses. Neither finding supplies a measured revenue loss or a guarantee against future attacks.
Sources: The Citizen Lab, Confiant
