Key Findings
- Devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements. We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection.
- The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.
- Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack.
- Analysis of four billion Discover-Tech bidding records shows that during a four-month period, the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.
- Discover-Tech’s ads also covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance. Discover-Tech is linked to mercenary spyware and intelligence threat actors beyond Candiru, including Intelos and Bindecy.
- A separate threat actor we call DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users. We will detail our findings concerning this threat actor in a separate forthcoming report.
- Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served ads via major networks such as Google, Yandex, and Beeswax. Discover-Tech has also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union.
- Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report.
- We call on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws, and make recommendations to lawmakers, defenders, and the advertising industry on how to stop AdFection-style attacks and espionage.
- We disclosed our findings to ad vendors and industry organizations. Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took action to disconnect Discover-Tech’s access to the digital advertising ecosystem. Other ad vendors we found to be involved in Discover-Tech’s operations did not respond to our request for comment within the timeline provided. We are also actively working with vendors to mitigate DARK CARTOGRAPHER’s mass-deanonymization attack.
This report is co-timed with an investigation by Confiant.
Read the Executive Summary of this report
1. Introduction
This section provides an overview of the online advertising ecosystem, and summarizes our findings about Discover-Tech.
The Online Advertising Ecosystem is Ripe for Abuse
When a user sees an ad on an app or a website, it is likely the result of a real-time auction, where advertisers bid on the chance to show that specific user that specific ad. So-called Real-Time Bidding (RTB) auctions, which are hosted on ad exchanges operated by companies including Google, take place hundreds of billions of times a day. In less than a second, the user’s device initiates a bid request, advertisers submit their bids, and the ad exchange determines the winner of the auction and pushes the ad to the user. Besides an image or video, an online ad can also contain code that runs within the app or browser that shows the ad.
Both advertisers and publishers of apps and websites use ad vendors that act as their intermediaries in these auctions. Advertisers typically buy ads via a so-called Demand-Side Platform (DSP), and a Supply-Side Platform (SSP) sells ad inventory on websites and apps.
Figure 1
Basic architecture of the online advertising ecosystem.
Malicious actors make use of two interrelated facets of the online advertising ecosystem:
The advertising ecosystem collects a lot of data and enables individual-level targeting: When a publisher of an app or website wishes to show ads, they add code from an SSP to their app or site. This code collects and shares granular information about the user and their device with ad exchanges to solicit bids for the ad slots. This information can include device identifiers and characteristics, precise location, and IP address data, as well as data about the app or website, and specifications about the ad slot. The DSP or advertiser then examines this information and decides whether they wish to bid on the impression in order to show an ad. The auction system is designed to enable targeting single individuals based on their mobile advertising ID, cookie ID, IP address, and other identifiers.
The advertising ecosystem allows many different third parties to run code in apps and websites: It is tempting to think of an online ad as, simply, a video or image. However, ads themselves may contain code from the advertiser, DSP, and other parties, and run it in the app or browser while the ad is shown to the user, for example to track users, ad impressions, and clicks. Code run by advertisers, DSPs, SSPs, and other third parties within apps and websites is often referred to as “tags”, “pixels”, “SDKs”, or “third-party tracking” more generally.
Exploiting Advertising Tech for Surveillance
The totality of information gleaned from ad auctions is quite valuable. A company with access to auction data can track users without their knowledge as they move around in physical space, or switch between cellular, Wi-Fi, and VPNs, by observing how bid requests tied to a specific identifier change location or IP address over time. In fact, the surveillance industry sells access to so-called ad intelligence (ADINT) platforms that leverage this sort of data, often combined with third-party tracking data. In recent years, several investigations and media reports have uncovered vendors that sell ADINT to defense, intelligence, and law enforcement agencies.
Zero-Click Spyware Delivered via Targeted Ads: AdFection
Beyond passive data harvesting, malicious parties can also exploit this infrastructure to target certain individuals based on user data included in ad auctions and then run malicious code on their devices. Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection.
There has been some reporting about the intersection between spyware and the advertising ecosystem. However, the specific ways mercenary spyware companies plug into the ads ecosystem to target particular users have remained largely secret. This report exposes zero-click spyware delivered via targeted ads, which we call AdFection , and is the first technical demonstration that mercenary spyware is being distributed via targeted advertisements.
Discover-Tech is a Bridge Between Mercenary Spyware Companies and the Advertising Ecosystem
We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse, including the automatic delivery of mercenary spyware when ads are displayed to a target and the mass profiling and deanonymization of users.
The company serves as a bridge between ad vendors and the mercenary spyware ecosystem. In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose. Its platform, Controlium, allows malicious actors to precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.
Figure 2
The website of Integrity Labs (the rebranded Candiru), one of the mercenary spyware companies working with Discover-Tech.
Discover-Tech appears to work with multiple mercenary spyware, hacking, and advertising vendors, connecting the spyware industry to the online advertising ecosystem. As we detail in this report, Discover-Tech ads are used to infect and profile on behalf of mercenary spyware vendor Candiru. We also detail connections between Discover-Tech and another mercenary hacking company, Bindecy, as well as connections with Intelos, a mercenary ADINT firm.
What is Discover-Tech and How Does It Operate?
Discover-Tech is led by its CEO Dekel Boni, who has a background in digital advertising. Eric Banoun, whom Haaretz describes as “one of the pioneers of offensive cyber in Israel”, joined the company’s board of directors soon after it was founded in 2020 and remained there until 2025. Between 2020 and March 2026, Discover-Tech’s shareholders included a company linked to Sara Hamou, who has managed the corporate network of the spyware group Intellexa.
Discover-Tech appears to place advertisements using several techniques. Firstly, the company operates a platform called MyDSP, which interfaces with online ad vendors including Google, Yandex, Vungle (Liftoff), and Sunteng. Secondly, separately from MyDSP, it purchases ads via the ad vendors Eskimi and Comcast-owned Beeswax (Freewheel).
A large number of ads placed by Discover-Tech contain a script tag pointing back to what the company refers to as a “ NOAS server” (also called a “getAd server”). This tag causes the ad, when rendered, to connect back to Discover-Tech, submit advertising identifiers for the user (either a cookie ID or a mobile ad ID), and automatically execute any JavaScript code returned. The NOAS server decides, apparently based on a combination of the source IP address and the advertising identifiers, whether the target is eligible to receive any JavaScript. If so, then code is returned. If not, a 0-byte response is returned. The NOAS server is a key part of Discover-Tech’s strategy, allowing Discover-Tech to avoid directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.
Figure 3
Discover-Tech bridges the mercenary spyware industry with the online advertising ecosystem.
As detailed in Section 9, Discover-Tech appeared on several lists of “certified” and “approved” ad vendors maintained by Google and the advertising industry association IAB Europe from the year 2020 until 2026. These listings helped make Discover-Tech appear to be a legitimate ad vendor and facilitate its participation in the digital advertising ecosystem at scale.
As a result of this investigation, both Google and IAB Europe removed Discover-Tech from their ad vendor registries in early October 2026. Google, which collaborated in the investigation, terminated Discover-Tech’s access to its ad exchange platforms. Beeswax removed Discover-Tech from its ad buying platform, Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains.
Report Overview: Exposing Discover-Tech’s AdFection Pipeline
In this report we provide an overview of the different types of ad abuse facilitated by Discover-Tech, the company’s ad targeting systems and practices, as well as its partners and corporate network.
In Section 2, we show how Candiru works with Discover-Tech to conduct AdFection attacks, and describe one such attack: the targeting and infection of devices at the international media network Al Jazeera with Candiru’s mercenary spyware.
In Section 3, we examine Controlium, a Discover-Tech platform that provides a control-panel style interface enabling mercenary spyware customers to target specific users with “controlled ads.”
In Section 4, we examine links between Discover-Tech and mercenary spyware companies Candiru/Integrity Labs and Bindecy. We then outline their relationships with other mercenary surveillance companies, including advertising intelligence (ADINT) vendor Intelos, and an ADINT vendor we refer to as DARK CARTOGRAPHER, which is building databases linking users’ mobile advertising identifiers to their phone numbers.
In Section 5, we analyze where Discover-Tech’s malicious advertisements land. We identified a Discover-Tech server that published almost four billion ad bidding records. These records show that Discover-Tech ads were served in almost 200,000 different Android apps, iOS apps, and websites in many countries. We also highlight specific countries and government networks where Discover-Tech’s advertisements had impressions.
In Section 6, we use technical analysis to examine how Discover-Tech deploys ads, tracks users and exchanges user identifiers with other ad vendors, including with Beeswax, Yandex, and Microsoft’s ad system Xandr.
In Section 7, we present our research on Discover-Tech Ltd, its corporate network, key persons linked to the company, the origins of its MyDSP advertising technology, and its connection to the wider advertising ecosystem.
In Section 8, we summarize what is known about the mercenary surveillance firms Candiru, Bindecy, and Intelos, and we further examine their activities and corporate networks in the context of the findings presented in our report.
In Section 9, we explore how major industry organizations and ad vendors helped enable Discover-Tech’s ad operations, including Google, IAB Europe, Beeswax (FreeWheel/Comcast), Vungle (Liftoff), Eskimi, Sunteng, and Xandr (Microsoft).
In Section 10, we discuss the implications of AdFection for user security and human rights.
In Section 11, we provide recommendations to lawmakers, regulators, defenders, and the advertising industry on how to mitigate and block threats from AdFection-style attacks.
The Citizen Lab sent requests for comment to 13 companies; their responses are included in full in the ‘Correspondence with Companies’ section.
2. How Discover-Tech’s AdFection Zero-Click Works
This section provides the first public technical confirmation of a zero-click spyware attack via targeted ads in the wild: the targeting and infection of devices at the international media network Al Jazeera with mercenary spyware. We refer to this type of attack as AdFection . Using network analysis, infrastructure fingerprinting, and analysis of implant behaviour, we connect Discover-Tech’s infrastructure with the distribution of Candiru’s mercenary spyware.
What AdFection Looks Like
The instances of Candiru AdFection via Discover-Tech ads all share similar characteristics. First, Discover-Tech wins a bid, and one of their ads is pushed to a website or app that is open on a user’s device. The user may see this ad, such as in Figure 4, though in some cases the ad may render in the background.
Figure 4
Discover-Tech ads that could have infected users with spyware. We were served these ads while browsing the CBC and Yahoo websites, and while using a Sudoku app on Android.
When the website or app receives the ad, it renders it, requesting JavaScript from a Discover-Tech server embedded within the ad. In most cases, the user who sees the ad is not selected for targeting, and the server will not return any JavaScript to be executed. Nevertheless, the ad will still gather data from the user’s browser and submit it back to Discover-Tech, which can include cookies set on the webpage including the ad, as well as the device’s public IPv6 address.
Confirming the Targeting of Al Jazeera with Candiru Spyware via Discover-Tech Ads
In 2024 and 2025, international news network Al Jazeera was targeted in a series of zero-click attacks that we link with high confidence to Candiru’s spyware delivered via Discover-Tech’s ads. At least 45 devices within Al Jazeera were targeted in these attacks.
Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed. Infected devices first show contact with domains from Discover-Tech infrastructure, indicating an ad impression. Next, the devices show connections with a Candiru validator server. The validator server performs an initial check of the device before it is further profiled and infected. Ultimately, an infected device communicates with a Candiru Command and Control (C&C) server. This temporal signature is illustrated by Figure 5.
Figure 5
Temporal signature of a Discover-Tech facilitated Candiru infection.
Fingerprinting Candiru Servers
We developed a fingerprint for Candiru validator servers. Both keyadapter[.]com and sharethere[.]net returned banners that matched the following regular expression on Censys.1 We refer to this as Fingerprint V1:
HTTP/1.1 [^\r\n]+\r\ndate: [^\r\n]+\r?\n(connection: [^\r\n]+\r\n)?content-type: [^\r\n]+\r\nserver: Apache[^\r\n]*\r\ncontent-length: [0-9]+\r\n.*
HTTP/1.1 [^\r\n]+\r\ndate: [^\r\n]+\r?\n(connection: [^\r\n]+\r\n)?content-type: [^\r\n]+\r\nserver: Apache[^\r\n]*\r\ncontent-length: [0-9]+\r\n.*
We found hosts on Censys matching Fingerprint V1 between August 2022 through July 2026, though we note that in May and June 2026, this behaviour gradually began being retired. In all, we found 305 distinct domain names on 319 IP addresses, though to save query costs we only searched one historical Censys snapshot per month. The set of 305 validator server domains we found includes ones publicly attributed to Candiru by Sekoia, as well as Recorded Future.
We also identified a separate fingerprint for the C&C servers used in the attack, Fingerprint C1. Four of the servers matched it (fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com). We could not locate a response in Internet scanning data for the other three.
HTTP/1.1 [0-9]+ \r\nDate: [^\r\n]+\r?\nContent-Type: text/html[^\r\n]*\r\nContent-Length: [0-9]+\r\nConnection: keep-alive\r\nserver: nginx\r\n$
HTTP/1.1 [0-9]+ \r\nDate: [^\r\n]+\r?\nContent-Type: text/html[^\r\n]*\r\nContent-Length: [0-9]+\r\nConnection: keep-alive\r\nserver: nginx\r\n$
Attribution of the Attack to Candiru
Al Jazeera isolated a Windows DLL file from one of the compromised devices which contains hardcoded Command & Control servers matching Fingerprint C1. The sample is available on VirusTotal.
Candiru spyware sample SHA256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8
This sample hard-codes two C&C servers that match Fingerprint C1: fearevolve[.]com and jobmarcher[.]com. The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report. For example:
-
Both samples use a COM hijack for persistence, though make use of different DLLs.
-
Both samples obfuscate strings using a 48-byte repeating XOR key, though the samples have different keys. Both samples also have an interesting quirk where obfuscated strings contain a “dummy” null-terminator character that is not deobfuscated (the deobfuscation with the key would be nonsensical), and is instead silently discarded. The only function of this dummy null-terminator appears to be to ensure that the right-size chunk of memory is allocated to hold the XOR-decrypted output.
-
The configuration within both samples hardcodes the same ordered list of domain names to fetch to check network connectivity: http://www.google.com and http://www.microsoft.com.
The combination of the COM persistence hijack, the use of a distinctive 48-byte repeating XOR obfuscation technique with a “dummy” null terminator, and the specific hardcoded network connectivity check leads us to conclude with high confidence that this sample is a newer version of the Candiru attack chain that we captured in 2021.
3. Exposing Discover-Tech’s Controlium: Malicious Ad Targeting Platform
This section examines Controlium, a platform that provides a control-panel style interface allowing mercenary spyware customers to target specific users with “controlled ads” that deliver malware. Discover-Tech published the full source code for Controlium’s frontend on the app’s login page, which allowed us to review and reconstruct the user interface.
Discover-Tech provides its customers with access to a platform called Controlium that appears to be specifically designed to allow them to push malicious content to individual targeted users alongside advertisements. Customers can use Controlium to select a user for infection or profiling based on their mobile advertising identifier (iOS or Android), browser identifier (MyDSP or Beeswax cookie ID), and/or IP address. Discover-Tech’s malicious ads (referred to as “controlled ads”) sometimes also contain branding of companies that are closely linked to Discover-Tech, or branding from apparently unwitting third-party companies, including Amazon and AliExpress. We have no evidence that these ads were purchased by Amazon or AliExpress.
As is standard for many web apps, the entirety of the source code for the Controlium frontend is included on the app’s login page. We visited the login page in a web browser and saved the page to disk to obtain a copy of the frontend.2 We modified our copy of the code to remove any communication with any external servers, and to reveal all available screens in the UI. We then opened this version in a web browser to explore the app’s user interface.
In our analysis of Controlium, we downloaded only publicly accessible resources without circumventing any access controls. Most data associated with Controlium, such as information about Discover-Tech’s customers and their operations, is intentionally protected with an authorization token. However, we were able to obtain data on Controlium user logins from an unauthenticated API endpoint (see below: ‘Unauthenticated Endpoint’). We also assess that it would have been possible for a hacker to spoof a valid authorization (see below: ‘Authentication Vulnerability’), although we did not test this.
Attribution to Discover-Tech
We found the Controlium platform available on the following websites:
www.controlium[.]net
powerium[.]net
adv45.volasim[.]com
adv50.volasim[.]com
www.controlium[.]net
powerium[.]net
adv45.volasim[.]com
adv50.volasim[.]com
These domain names all had CNAME records pointing to an AWS Application Load Balancer (ALB) with the name:
discovertech-alb-100966113.us-east-1.elb.amazonaws[.]com
discovertech-alb-100966113.us-east-1.elb.amazonaws[.]com
Additionally, several strings in the Controlium code directly reference Discover-Tech:
controlium-discover-tech
https://discovertech.us.auth0.com
controlium-discover-tech
https://discovertech.us.auth0.com
Furthermore, if a user tries to access a particular endpoint in the app called “/jsConfig”, the app displays the following message, which is a possible reference to Discover-Tech’s CEO Dekel Boni:
message = 'ONLY DEKEL IS ALLOWED!!!';
message = 'ONLY DEKEL IS ALLOWED!!!';
Finally, an unauthenticated API endpoint (see below: ‘Unauthenticated Endpoint’) shows frequent login activity from users whose names overlap with Discover-Tech employees on LinkedIn.
Controlium: Examining Admin Mode
An account designated as an “admin” on the Controlium platform can configure a number of different parameters for customers of the platform. First, an admin may grant a customer access to the web interface, or the API. It also appears that the Controlium product can be “white labeled” with a different logo, and that access can be restricted to specific IPs.
Figure 6
The user admin interface of Controlium
Next, admins may add restrictions on what type of campaigns a customer may run. These restrictions control which combinations of user IDs and IP addresses they are allowed to bid on, and which “URL Types” they can access.
Figure 7
Screenshot of Controlium’s admin interface with all options checked.
Customers can have certain “OpSec” restrictions placed on their ad bidding, which appears to be an effort to ensure that customers are not bidding too frequently or too broadly:
Figure 8
Screenshot of Controlium’s admin interface.
There is also another type of “OpSec” called “Ad URL OpSec”, which we explore more in Section 4.
Figure 9
Screenshot of Controlium’s admin interface.
Customers can be further restricted based on how many campaigns they can run daily or monthly, or restricted based on a “Domains Whitelist” or “Apps Whitelist”, which appear to control on which domain or within which mobile apps ads can be bid on. As is customary for licensing of an attack platform, customers can be restricted to only bid on ads in certain countries via either an allowlist or blocklist.
Figure 10
Screenshot of Controlium’s admin interface.
Controlium: Examining Customer Mode
The exact steps a user or customer would need to take to use the platform are not clear. The Controlium user interface includes a number of modules and forms that provide, in part, overlapping functionality to set up ad campaigns and monitor ad data.
Controlium users can create a “tag”, which defines a combination of an ad image, a landing page, a “NOAS URL” (see below: ‘A Look at the NOAS Server’), and URLs for logging impressions and clicks.
Figure 11
Screenshot of Controlium’s Tag Generator module.
Users can select a DSP to use for delivering the ad. The available options include Beeswax, Eskimi and Discover-Tech’s own MyDSP. When selecting MyDSP, they can also choose whether to use the Google or Yandex ad exchange.
Figure 12
Screenshot of Controlium’s Tag Generator module.
Controlium’s “OP Creative Upload” module allows users to upload and configure advertising content (e.g. an ad), and then upload the data to a DSP. Users can attach a tag to the ad either by defining a landing page, a NOAS URL and URLs for logging impressions and clicks, or they can paste a “Custom Tag” generated by the “Tag Generation” module.
Figure 13
Screenshot of Controlium’s “OP Creative Upload” module.
The available DSP options include “MyDSP WW”, “MyDSP Yandex RU”, “Beeswax (Palm 3)”, “MyDSP Google (Palm 3)”, and others. Users can also select several “Add Ons” including “Infinite FIFO”, “Detect Zuid”, and “User Agent”.
Another module labeled “Campaigns” allows Controlium users to associate “Ad URLs” to selected “controlled ads”, which can be served either in mobile apps or on websites, according to Controlium’s source code. As shown in the screenshot, the module allows users to define target “User IDs” and select a “URL Type”.
Figure 14
Screenshot of Controlium’s “Campaign” module.
The URL types available for selection include “Ad URL”, “Test URL”, “Script”, “User Agent”, “Monitor”, “Pixel”, and “De-anon”. We are unsure what most of these options mean, but we think that for “Ad URL”, the NOAS server returns JavaScript adding a 1×1 iframe to the page pointing at the specified URL, and “Script” may be designed to allow arbitrary JavaScript to run. Any URL is delivered via the NOAS Server (see below: ‘A Look at the NOAS Server’).
Authentication Vulnerability
While the data associated with Controlium’s customers and their operations are nominally protected with an authorization token, it appears that it would be easy for a hacker to spoof a valid token. We did not attempt to exploit this issue, as we believe doing so would have constituted unauthorized access to Discover-Tech’s systems.
Figure 15
Controlium incorrectly derives the authentication token from encrypted user metadata, instead of the signed JWT returned by Okta.
The underlying issue stems from Discover-Tech’s improper use of Okta’s Auth0 product. When a Controlium customer authenticates with Auth0, a JWT is returned to their browser. This token is digitally signed by Auth0, and contains information about scopes and expiry that the backend server should validate. However, Controlium ignores this token and instead passes a separate user object as a token to the backend server. The user object simply contains unauthenticated metadata about the user, such as their name and email address. Controlium encrypts this information with a secret key published in the Controlium platform.
Interestingly, the correct code to use the JWT as an authorization token was present within the Controlium platform, but was commented out in lieu of the vulnerable code.
Unauthenticated Endpoint
During our analysis of the Controlium platform, we observed that the source code mentioned an endpoint called “/csv-download”, which accepted start and end date parameters. When we sent normal HTTP GET requests to this endpoint without any password, special headers, or authentication token, we received logs showing which users had logged in to Controlium, and from which IP addresses. We successfully exported authentication logs for 128 days and identified 120 distinct usernames logging into the Controlium instances on controlium[.]net and powerium[.]net. We further delve into this data in Section 4.
A Look at the NOAS Server
We were able to elicit code from NOAS servers by testing “dummy” User ID values. For example, we observed that a visit to:
https://pqv2.mtrtb[.]com/getAd?idfa=test2
https://pqv2.mtrtb[.]com/getAd?idfa=test2
Yielded the following content:
var ifrm = document.createElement("iframe"); ifrm.setAttribute("src", "https://logger.powerium.net/register_event?user=dbdt&user_id=test2&bundle=&domain=&user_sha1=&exc=&name=test2&bt=&ai=&referer=&devicemodel="); ifrm.style="width:1px; height:1px; border:none;"; document.body.appendChild(ifrm);
var ifrm = document.createElement("iframe"); ifrm.setAttribute("src", "https://logger.powerium.net/register_event?user=dbdt&user_id=test2&bundle=&domain=&user_sha1=&exc=&name=test2&bt=&ai=&referer=&devicemodel="); ifrm.style="width:1px; height:1px; border:none;"; document.body.appendChild(ifrm);
We also found that we could task a NOAS server for a similar Discover-Tech app published on events-ui.myweb3id[.]io called “Mini Platform C”.
Figure 16
Screenshot of the “Mini Platform C” app.
We input a User ID, “test123” into this form, and an AD URL, “https://example.com/”, then we observed the tasking by visiting this NOAS URL:
https://events.platc-tester[.]com/cplatform/getAd?idfa=test123
https://events.platc-tester[.]com/cplatform/getAd?idfa=test123
The first time we visited it, the URL returned this:
var ifrm = document.createElement("iframe"); ifrm.setAttribute("src", "https://example.com/"); ifrm.style="width:1px; height:1px; border:none;"; document.body.appendChild(ifrm);
var ifrm = document.createElement("iframe"); ifrm.setAttribute("src", "https://example.com/"); ifrm.style="width:1px; height:1px; border:none;"; document.body.appendChild(ifrm);
Subsequent visits returned nothing. This version of “Mini Platform C” does not appear to support any other options besides “Ad URL” for tasking the NOAS server. A similar version of the “Mini Platform C” app is also available on the site events-ui.discover-tech[.]io. The JavaScript code for both app versions is available on archive.org ( 1, 2).
Additional Customer Mode Functionality
The Controlium platform provides several additional modules, according to our analysis of the app’s user interface and source code.
Two Controlium modules named “Targeting” (also known as “Targeting Config”) and “cTargeting” (also known as “Upload Audiences”) allow users to upload digital identifiers referring to single or multiple targets, including mobile advertising IDs for Android and Apple devices, Beeswax user IDs, MyDSP user IDs and IP addresses. The “Targeting Config” module attaches the uploaded identifiers to a “segment”, a widely used term that describes lists of identifiers to be used for targeting in digital advertising.
Controlium users can view data on ad impressions for a target identifier or IP address in the last 30 minutes:
Figure 17
Screenshot of Controlium’s “Ads Impressions” module.
A similar module named “Bid Requests” allows users to view data on recent ad bid requests for a specific target identifier or IP address. It provides a list of records that contain user IDs, the website visited or app used by the user, the IP address of the user’s device and other attributes.
Figure 18
Screenshot of Controlium’s “Bid Requests” module.
The “Events Logger” module provides access to activity records related to ad serving. The available data sources in another Controlium module named “OP Reporting” include MyDSP, Beeswax, Google, and Facebook. We are unsure what kind of reporting data would be displayed by that module. The “Ads Dashboard” module provides reports about ad impressions, the number of users reached and the amount spent (in $) for active campaigns.
Three Controlium modules named “User Info”, “User API Info”, and “User Sync Info” appear to provide key/value information on specific users upon entering user identifiers. They mention a number of attributes which we do not fully understand. For example, they offer to display user identifiers labeled “UUED” and “UUPD”. One module provides a “User ID Type” selection. The available options include “EYield”, “TYield”, “VYield”, “SYield”, “Sync_User”, “Sync_Domain”, “Sync_App”, “AH_User”. Some of these options appear to be related to user ID syncing across different vendors, which is further examined in Section 6.
The modules that provide access to information on bid requests, ad impressions, events, and users can be used for troubleshooting and verification purposes, but also to spy on targets and other users whose data is in the bid requests.
4. Discover-Tech’s Links with Mercenary Spyware, ADINT, and Mass Surveillance Vendors
This section examines links between Discover-Tech and the mercenary spyware companies Candiru and Bindecy. We also illustrate that, beyond facilitating mercenary spyware delivery, Discover-Tech is linked to ADINT firms, including Intelos. Discover-Tech also supports mass-deanonymization of internet and app users by a threat actor we call DARK CARTOGRAPHER, which exploits vulnerabilities in mobile networks to unmask users’ phone numbers.
Links with Candiru/Integrity Labs
We observed that Discover-Tech sends encrypted ad impression data to Candiru using Controlium’s “Ad URL OpSec” feature. We identified several 2024 and 2025 Candiru infection links to at least six domains matching Fingerprint V1 and that also contained a parameter “?q=” whose value was 16 bytes of data in Base64-encoded form. In every case, the value of the “?q=” parameter was correctly decrypted with the “V1” AES-256 key published on a page called “Ad URL OpSec Decoder” on the website myipinfo[.]io. The website myipinfo[.]io is clearly linked to Discover-Tech: passive DNS data shows multiple overlaps in IP addresses and CNAME records with other Discover-Tech websites, including powerium[.]net and myweb3id[.]io (see also Section 7).
One case of a Candiru infection link bearing a Discover-Tech Ad URL OpSec parameter is listed publicly on VirusTotal. The “?q=” parameter decrypts to an IP registered at the Saudi Ministry of Foreign Affairs, indicating that organization as a potential target of Candiru spyware via Discover-Tech ads:
Figure 19
Discover-Tech’s “Ad URL OpSec Decoder” shows that a Candiru infection link submitted to VirusTotal bears opsec data indicating the Saudi Ministry of Foreign Affairs as a likely spyware target.
We assess that this opsec data is included to facilitate a secure handoff from Discover-Tech to an attacker. The attacker presumably compares the visitor IP for the infection link against the IP encrypted by Discover-Tech, to make sure the link from the ad impression was not silently swapped to a different device (as a security researcher might want to do to capture an exploit).
Tracking the Candiru/Integrity Labs Pre-Sales Team
Based on our analysis of Controlium user logins from an unauthenticated API endpoint ( Section 3), we identified two users who logged in to Controlium from an IP address in Israel that we attribute to Candiru/Integrity Labs. One of these users, which we refer to as INTEGRITYPRESALE1, matched the name of someone listed on LinkedIn as having a “Head of Presale” position in Israel at “Cyber Security Company”. The “Cyber Security Company” page is nominally for a Jakarta-based company, but we think the user selected this page because it has a generic name that conveys the industry in which they work without naming the specific company. Viewing the “Cyber Security Company” page on LinkedIn shows “Integrity Labs”, “NSO Group”, and “Integrity Lab” (apparently a typo of “Integrity Labs”) in the top three spots in the “pages people also viewed” panel.
Figure 20
The page of Integrity Labs, as well as a typo version both appear in “Pages people also viewed” for “Cyber Security Company” on LinkedIn.
The second user signing in from the Integrity Labs IP address, which we refer to as INTEGRITYPRESALE2, has a username that appears to include a first name, and ends in “_pap_pres”. We suspect the “_pres” stands for “presale”. There is a user on LinkedIn who shares a first name with this user, and is a “Presales Engineer” at “Cyber Security Company”, though we cannot be certain it is the same individual.
We identified INTEGRITYPRESALE1 and 2 signing into Controlium from locations in the following countries: Azerbaijan, Czechia, Israel, Italy, Mexico, Montenegro, UAE, and the United States.
We are unsure what the phrase “pap” refers to, but we noted only two other usernames that contained the string “pap”. They were part of a cluster of users signing in exclusively from the local IP address 10.0.0.52, suggesting these as further possible Candiru-linked users:
Aurora_api, Barbara, Chameleon, CS, Fox, Heron, Journey, MobyDick, Oris, papdev2, papplayg, Presale, Scorpion, spare2
Aurora_api, Barbara, Chameleon, CS, Fox, Heron, Journey, MobyDick, Oris, papdev2, papplayg, Presale, Scorpion, spare2
Candiru’s Profiling Servers
While tracking Candiru’s infrastructure in 2025, we noticed that two domain names that matched our Fingerprint C1 were registered within two hours of each other on March 18, 2025 with info@rockhoster[.]com in their SOA record:
outdooutcome[.]com
suggestutterly[.]com
outdooutcome[.]com
suggestutterly[.]com
A third domain that looked similar was registered on March 18, 2025 within the same timeframe, also with info@rockhoster[.]com in its SOA record, but it never matched our Candiru fingerprint:
sincereaccertain[.]com
sincereaccertain[.]com
However, we noted that starting in April 2025, URLs pointing at sincereaccertain[.]com were distributed via Discover-Tech ads. The URLs looked like this:
https://sincereaccertain[.]com/?qq=[...]
https://sincereaccertain[.]com/?qq=[...]
The qq parameter contained Base64 data. Pasting the Base64 data into Discover-Tech’s “Ad URL OpSec Decoder” (see above) resulted in a successful decrypt using their “V2” AES decryption scheme. The decrypted data looked like this:
|||
|||
In May 2025, we observed d1fcoizt7mje85.cloudfront[.]net with URLs and data that decrypted to the same format. We conclude that sincereaccertain[.]com is linked to d1fcoizt7mje85.cloudfront[.]net because URLs to both domain names appeared to be distributed via the same Infinite FIFO ID, number 778. Deployment of the d1fcoizt7mje85.cloudfront[.]net URLs appeared to cease in December 2025. We estimate that between hundreds of thousands and millions of users were directed to these domains via Discover-Tech ads.
We identified no similar activity until January 2026, when Discover-Tech appeared to evolve their Infinite FIFO feature. The NOAS URL associated with these new Infinite FIFOs was ppv2[.]mtrtb[.]com. We were able to gather statistics from an unauthenticated endpoint on this server for five months between January 2026 and June 2026, when Discover-Tech removed the unauthenticated endpoint. The statistics counted (among other things) the number of “ eligible users”, which appeared to be the number of users who were directed to ppv2[.]mtrtb[.]com and who were intended to receive some infinite FIFO code. We counted a total of 3,637,213 eligible users during this period, though we note that it is possible that Discover-Tech customers other than Candiru may make use of the Infinite FIFO feature.
Later in 2026, we noted a migration to what we assess is “V3 OpSec”, which allows a custom name to be specified for the parameter instead of “qq” (we noted “impid”), and a per-user key. Discover-Tech neglected to update their “Ad URL OpSec Decoder”, so we were unable to decrypt this data.
We were unable to obtain any of the JavaScript code from sincereaccertain[.]com or these CloudFront distributions, likely because of Discover-Tech’s Ad URL OpSec feature, though we note that Confiant was able to obtain related code.
Bindecy
Based on our analysis of user logins from an unauthenticated API endpoint (see Section 3), we noted that two users, maya and mayaqa, were logging into Controlium from multiple IP addresses including an IP address in Israel 62.90.129.xxx. We noted that this IP address was administering multiple websites that had self-signed certificates issued by “ cupid-ca”:
beachvibesnow[.]com
enjoymultiplecats[.]com
icecreamtester[.]com
beachvibesnow[.]com
enjoymultiplecats[.]com
icecreamtester[.]com
We identified a total of seven certificates on Censys issued by “cupid-ca”. Other domain names included pickarest[.]com and infoanalytics[.]live. Both pointed to IPs that returned a distinctive speedtest page on port 8443 without TLS:
services.http.response.body_hashes="sha256:63c2963a7abc1e4ee083275e5582a52f1101dba9905fd35498726359abf95a71"
services.http.response.body_hashes="sha256:63c2963a7abc1e4ee083275e5582a52f1101dba9905fd35498726359abf95a71"
One of the IPs that matched this same fingerprint was 52.174.65.77, while it was pointed to by the domain:
archer.westeurope.cloudapp.azure[.]com
archer.westeurope.cloudapp.azure[.]com
Other domains pointing to the same IP were connected to a Heroku app:
bd-mainserver.herokuapp[.]com
bd-mainserver.herokuapp[.]com
From talking to our partners, we understand that Bindecy has products called “Archer” and “Cupid”. We believe the “bd” in “bd-mainserver” may also be a reference to Bindecy.
Some of the domain names we mapped to Bindecy were registered in the name of an Israeli software company, Moveo Group. Additionally, one of the domain names appeared to be a domain name bearing the name of an Israeli web developer and entrepreneur without any obvious connection to Bindecy.
We were able to fingerprint Bindecy’s servers and identify locations of some Bindecy operators: Belgium, Germany, Norway, Portugal, Sweden, Singapore, and Spain. We also identified a customer that appeared to be using Bindecy’s spyware in Mexico and Colombia, but were not able to determine the location of the operator.
We further discuss the Israeli spyware vendor Bindecy and its corporate network in Section 8.
Bindecy did not respond to our request for comment within the timeline provided.
Links with Intelos, DARK CARTOGRAPHER, and Other Vendors
Intelos
Based on our analysis of user logins from an unauthenticated API endpoint ( Section 3), we identified several users logging in to Controlium from IP addresses that returned certificates for globaldatapoints[.]com. We identified passive DNS data showing a CNAME record for a subdomain of globaldatapoints[.]com that contained the word “Intelos”.
Figure 21
A subdomain of globaldatapoints[.]com contains a CNAME record to an AWS Elastic Load Balancer whose name contains the string “intelos”.
Furthermore, a subdomain of globaldatapoints[.]com briefly returned a login page for an application called “AD/HOC”, which has been reported to be the name of an Intelos product.
Figure 22
An IP pointed to by a subdomain of globaldatapoints[.]com returned an app called “AD/HOC”.
We identified at least 15 Controlium users that we believe are linked to Intelos. Table 1 shows users that signed in from locations that did not appear to be VPNs or proxies:
| Username | Sign-ins from |
|---|---|
| bear | Belgium, Israel, Singapore, Poland |
| timtamteam64 | Israel, Spain |
| liinine77263, johny7716243 | Macedonia |
| Landrover | Spain |
| bear_solo | Hungary |
| carpe_eb | Israel, Portugal, UAE |
| rollsgreen1 | Spain |
| JonG | Belgium, Czechia, Greece, France, Israel, Italy, Serbia |
| mishreg | Israel, Latvia |
| Barhi | Israel, Thailand |
| metalica1 | Belgium |
Table 1
Controlium sign-ins from Intelos-linked users.
The mercenary ADINT vendor Intelos, which reportedly offers both ad-based geolocation surveillance and the delivery of spyware via ads, has additional links to Discover-Tech via Intelos shareholder Eric Banoun (2018 – present), who was also a director of Discover-Tech (2020 – 2025), as detailed in Section 8.
Intelos did not respond to our request for comment within the timeline provided.
DARK CARTOGRAPHER: Mass-Deanonymization With Ads
We identified Discover-Tech ads that sought to exploit the well-known “WebRTC IP Leak” issue, which can potentially reveal the IP address of VPN and proxy users. The same ads also attempted to unmask the phone number (MSISDN) of mobile users who were served the impression. The MSISDN leaks exploit various issues, including widespread problems with so-called “zero-click login” technologies, which aim to facilitate frictionless authentication and purchases for users on their mobile devices.
One way “zero-click login” operates is that mobile providers select certain websites for “HTTP header enrichment,” so that when plaintext HTTP requests pass through the provider’s mobile gateway, an HTTP header (like X-MSISDN) is added to the request that provides the user’s phone number to the website. As an alternative to HTTP header enrichment, third-party services may work directly with the telco to facilitate this “zero-click login”. There appear to be widespread bugs with this allowlist matching, as well as bugs or security issues in third-party enrichment providers. While mainstream web browsers such as Chrome are moving towards blocking any non-HTTPS requests, it is likely that the app ecosystem will still embed webviews that permit non-HTTPS content.
We taxonomized the issues into five types, exploited by attackers across numerous mobile providers in more than 30 countries in North America, South America, Europe, Africa, and Asia, and disclosure to companies is in progress. Once the disclosure process is complete, we will release our subsequent report delving into technical analysis and attribution of these attacks.
Notably, DARK CARTOGRAPHER’s infrastructure links to both a mercenary adtech vendor and a U.S. government contractor. It is rare to see such direct overlaps between mercenary vendors and U.S. government or intelligence contractors. We assess that this attacker has been exploiting MSISDN leak issues since at least 2019, fronted by a variety of mercenary adtech companies. Our investigation into this threat actor is ongoing.
Other Vendors
We found a number of Controlium users that we could not conclusively attribute to a specific company: the user mi19mos25a primarily logged in from India, and occasionally Israel; the user rcs1 exclusively logged in from Italy, primarily a static IP in Milan; the user Pindi exclusively logged in from Pakistan.
5. Uncovering Discover-Tech’s Billion-Bid Scale Ad Targeting
To understand the scope of Discover-Tech’s activity, we analyzed nearly four billion ad bidding records that were publicly exposed on a Discover-Tech website. We found that Discover-Tech ads were displayed in over 70,000 mobile apps, and over 120,000 websites between March and June 2026.
We found two world-readable Apache Druid instances running on Discover-Tech’s website mtrtb[.]com. The druid.mtrtb[.]com endpoint contains bidding data for Discover-Tech’s MyDSP platform, which is connected to several upstream ad providers including Google, Yandex, Vungle, and Sunteng. The cn.druid.mtrtb[.]com endpoint appeared to contain additional bidding data for Discover-Tech’s use of Sunteng. These instances did not contain any information about Discover-Tech’s use of Beeswax or Eskimi DSPs. Discover-Tech appeared to shut down both instances in August 2026.
There were no instances of cookie IDs, advertising IDs, or GPS coordinates recorded in the Druid data. However, the data includes IP addresses or /24s, presumably provided by SSPs, as well as ci
