Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
What Happened, in Brief
- October 15, 2026: Citizen Lab publishes Report 195, “Exposing AdFection,” and Confiant publishes a co-timed technical investigation titled “ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming.”
- Early October 2026: According to Citizen Lab, Google and IAB Europe removed Discover-Tech from their ad vendor registries after the researchers disclosed their findings. Google terminated its access to Google’s ad exchange platforms. Beeswax removed it from its buying platform, Vungle (Liftoff) paused its access pending review, and Eskimi blocked its accounts and domains.
- After publication: IAB Europe writes to TCF participants that Discover-Tech is suspended from the GVL after its own audit found violations of the TCF Policies, and that further confirmation of the published findings could justify definitive expulsion.
- Open questions: Citizen Lab calls on regulators to investigate whether Discover-Tech and Candiru, the spyware vendor it links to the activity, violated applicable laws, and says its own investigation is continuing.
What the Researchers Say Discover-Tech Was Doing
The technique: “AdFection”
Citizen Lab coined the term AdFection for a style of attack in which a targeted advertisement becomes the delivery vehicle for spyware. The mechanics rely on features that exist in every real-time bidding auction: the ad exchange broadcasts identifiers such as a mobile advertising ID or IP address, an advertiser can bid on a single device, and an ad can contain code that runs when it renders. Citizen Lab’s argument is that an attacker who controls the code behind an ad can decide, device by device, whether to send nothing or to send something malicious.| Step | What happens | Why it is hard to see |
|---|---|---|
| 1 | Discover-Tech wins an auction and an ad renders in an app or on a website | It looks like any other programmatic impression |
| 2 | The ad contains a script tag that calls back to a Discover-Tech server and submits the user’s advertising or cookie ID | The ad creative itself contains no exploit |
| 3 | The server decides, based on the identifiers and IP address, whether the device is a target | For most users it returns an empty response, so nothing visible happens |
| 4 | For a selected target, it returns code that hands the device off to the spyware operator’s infrastructure | The platforms that served the ad never see the malicious code or even a pointer to it |
| 5 | A browser or app exploit installs the implant | Citizen Lab describes this as zero-click, because displaying the ad is enough |
The platform: Controlium
Citizen Lab reports that Discover-Tech operates a platform called Controlium, which it describes as a control panel that lets customers select a specific device by advertising ID, browser identifier or IP address and send it a “controlled ad.” The researchers reconstructed the interface from front-end code that was publicly served on the platform’s login page, and they report that the tool includes restrictions on which countries, apps and domains a customer may target, along with operational security features. They also document a vulnerability in how the platform handled authentication and an unauthenticated endpoint that exposed login records, without attempting to exploit either beyond what was publicly accessible.The confirmed victim and the spyware vendor
Citizen Lab says it links, with high confidence, a series of zero-click attacks on international news network Al Jazeera in 2024 and 2025 to spyware from Candiru (reportedly now owned by US-based Integrity Labs), delivered via Discover-Tech ads. At least 45 devices at the network were targeted, according to the report, and Al Jazeera provided network logs and a malware sample that the researchers analyzed. Candiru was placed on the US Commerce Department’s Entity List in 2021. Citizen Lab also links Controlium users to other surveillance vendors, including Bindecy and Intelos, and describes a separate threat actor it calls DARK CARTOGRAPHER that used Discover-Tech infrastructure to try to link advertising IDs to phone numbers.The scale
The numbers in the reports explain why the industry is paying attention.- Citizen Lab analyzed nearly four billion bid records that were publicly exposed on a Discover-Tech server, covering March through June 2026. In that window the company’s platform bid on about 3.77 billion impressions and appeared to win about 442 million.
- About 19 percent of the bids were for ads that appeared to contain a script tag pointing back to the company’s selective-delivery server, and those ads were shown in more than 75,000 mobile apps and on more than 120,000 websites across 161 countries by geolocation.
- The platform’s recorded spending over the four months was about $109,000, but the researchers found almost no recorded revenue and no recorded conversions, the kind of data a real advertising business would generate, and most of the advertisers named appeared to be the company’s own properties or borrowed branding. Citizen Lab says it found no evidence of legitimate advertising activity.
- Citizen Lab reports that the ad impressions landed on networks associated with ministries, armed forces, intergovernmental bodies, critical infrastructure, universities, media organizations and technology companies. It stresses that an impression does not prove targeting or infection, but argues that the ability to bid on and display ads on such networks shows the systemic risk.
- Confiant estimates the operation served roughly 10 million ad impressions per day and found that its cookie matching infrastructure generated billions of audience touch-points per month across tens of thousands of websites.
What Confiant Found From the Publisher Side
Confiant approached the same company from the opposite direction. Its business is detecting malicious ads that reach publishers, and the firm says this case was an outlier because the typical operators it tracks are financially motivated scammers, while this one showed none of the usual signs of monetization. The investigation window ran from April 1 through September 10, 2026, and began with an ad creative that triggered Confiant’s detection heuristics on April 12, 2026.Cloaking and a covert command channel
Confiant reports that the ad loaded a small script that handed off to infrastructure Citizen Lab attributes to Candiru. That infrastructure staged a heavily obfuscated JavaScript development kit that fingerprints devices, monitors behavior and polls an operator-controlled server for instructions, including the ability to run arbitrary code pushed down by the operator. Confiant says it has never seen another advertising operator build a proper cryptographic protocol for its command channel. It stops short of claiming to have captured a full exploit chain in the wild, and says the staging shows a capability built to evaluate targets before delivering high-impact payloads.First-party cookie capture at scale
The finding most relevant to publishers is the second one. Confiant reports that in many campaigns the ad code read the visitor’s cookies from the page and posted them back to Discover-Tech before deciding what to deliver next. Where an ad renders in a context that shares the publisher’s origin, or is written directly into the page, that can expose every first-party cookie that is not marked as inaccessible to scripts. In Confiant’s telemetry across more than 1,000 publisher domains, the captured strings included analytics and advertising identifiers and, in many cases, session identifiers, including live authenticated sessions, and sometimes email addresses and names encoded in tokens. Confiant also says this collection continued where Discover-Tech lacked user consent under the GDPR.Ad creative and targeting patterns
Confiant found that about 60 percent of the creatives it saw in August 2026 were affiliate placements using borrowed brand imagery, and that more than a third of the spend promoted a free IP lookup site the company itself operates. Its targeting analysis showed bursts of activity in particular countries and operating systems, including a heavy focus on Android in Palestine, Lebanon and Belgium and on iOS in the Netherlands, Sweden and Norway. The hand-off to the spyware operator’s infrastructure occurred at very low volume, in the hundreds to low thousands of impressions per day across nine countries, which Confiant says may indicate deliberate micro-targeting. Its assessment is that the company may have used passive data collection to build an identity graph from which spyware actors could pick de-anonymized targets by advertising ID. Confiant adds a caution that applies to every interpretation of this data: being reached on a government or sensitive network does not by itself mean an individual was targeted, since a network identifies an organization and not a person.How a Consent Framework Became Part of the Cover
Both investigations point to the same uncomfortable fact: Discover-Tech used the machinery of compliance as part of its disguise.- Vendor registration. Citizen Lab reports that Discover-Tech appeared on IAB Europe’s Global Vendor List from 2020 until 2026, and on Google’s lists of certified external vendors, ad technology partners and ads personalization providers over the same period. The researchers say those listings helped the company look like a legitimate ad vendor and take part in the ecosystem at scale, despite company records that linked it to well-known figures in the spyware industry. Citizen Lab cites, among other things, a board member between 2020 and 2025 who co-founded surveillance firms affiliated with NSO Group and Intellexa, and a shareholder linked to a person who was sentenced by a Greek court, pending appeal, for her role in a spyware scandal.
- Consent signals in the browser. Citizen Lab found tracking pixel code that, when it detected a visitor in a region where the GDPR applies, used the TCF to process consent signals for three TCF vendors: Discover-Tech, Xandr and Beeswax. The researchers say this shows how the company leveraged its approved-vendor status to look GDPR-compliant while facilitating abusive activity.
- Cookie syncing at web scale. Citizen Lab and Confiant both describe Discover-Tech domains that exchanged user identifiers with other ad vendors on large numbers of publisher pages, including major news and entertainment sites. Confiant reports that one of those domains ranked in the top 7,500 on Cisco Umbrella’s popularity list before it was taken down, and that both were suspended on October 1.
The Accountability Gap IAB Europe Just Described
IAB Europe’s notice to participants is candid, and it deserves to be taken at face value. The organization runs compliance programmes for consent management platforms and vendors. Its vendor programme audits live vendor implementations and can suspend vendors from the GVL until compliance failures are remedied. In this case it says an audit identified violations of the TCF Policies, and the suspension stays in place until they are fixed and verified. It also invites the market to report suspected non-compliance through a submission form. But IAB Europe also says that conduct outside the TCF’s substantive scope is not something it is equipped or mandated to investigate independently, and that it will monitor findings by competent authorities. In plain terms, the framework polices adherence to its own policies about signals, purposes and legal bases. It is not a security vetting program, an ownership screening program or a threat intelligence service. That has practical consequences for each part of the ecosystem.| Who you are | What the TCF listing does tell you | What it does not tell you | What you still own |
|---|---|---|---|
| Publisher | The vendor registered and agreed to the Framework Policies | What the vendor’s code does at runtime, who ultimately controls it, whether its creatives carry hidden script calls | Your site’s security, your visitors’ data and your own notice obligations |
| Advertiser or agency | The vendor appears on a recognized list | Whether the vendor’s supply path is legitimate or its spend is legitimate advertising | Brand safety, data-sharing choices and the vendors in your media plan |
| Consent platform customer | The vendor is selectable in your consent interface | That every vendor you show in your banner deserves to be there | Which vendors you enable, how many you load and what you disclose |
| Vendor | You passed registration checks | That your downstream partners and customers are who they say | Due diligence on your own customers and supply chain |
Why regulators will not treat this as someone else’s problem
Under the GDPR, a company that decides to place third-party code on its pages remains responsible for the processing that results, and the allocation of roles between publishers and ad tech vendors is a question regulators have scrutinized for years. If the researchers’ findings about first-party cookie capture are borne out, publishers whose pages exposed session identifiers or authenticated sessions to an ad vendor may face questions about security measures and, depending on the facts, breach assessment duties. Whether any particular publisher faces legal exposure turns on its facts and its jurisdiction, so counsel should assess each situation. What is clear is that “the vendor was on the list” is a thin defense when the question is what you allowed to run on your site. The same logic applies in the United States. As our analysis of the Coalition State of Web Privacy report shows, plaintiffs and regulators increasingly count and examine every third-party vendor loaded on a page. A vendor you cannot account for is a liability whether it turns out to be an annoying tracker or something far worse.What to Do This Week: A 48-Hour Triage for Publishers and Advertisers
You do not need to wait for a regulator or a vendor to tell you whether you were touched. A focused review can be done quickly, and the output doubles as evidence that you acted promptly.- Check your vendor list. Open your consent platform and your TCF vendor configuration and confirm whether Discover-Tech Ltd is enabled. IAB Europe has suspended it from the GVL, but your configuration, cached vendor lists and any custom lists may still reference it. Remove it and record the date.
- Hunt for the published indicators. Ask your security team to search proxy logs, content security policy violation reports, tag manager histories, ad server logs and mobile app network telemetry for the domains named in the research (see the table below). A match does not prove you were targeted, and no match does not prove you were not, because the operators reportedly rotate infrastructure.
- Ask your ad partners directly. Contact your supply-side platforms, exchanges and ad operations vendors and ask whether Discover-Tech demand ran on your inventory, in which apps or domains and over what period. Put the question in writing.
- Harden what ads can reach. Confirm that session cookies are marked HttpOnly, Secure and appropriately SameSite so ad scripts cannot read them, and that ads render in sandboxed or cross-origin frames rather than being written into your page. Review your content security policy for outbound connections you cannot explain.
- Preserve and document. Keep dated records of what you checked, what you found and what you changed. If you do find evidence of exposure, bring in counsel and your incident response process immediately, and consider notification duties that may apply in your jurisdiction.
Domains and infrastructure named in the research
The domains below are those that Confiant and Citizen Lab identify as associated with Discover-Tech or the delivery chain. They are shown in the researchers’ defanged format so they are not clickable. Do not browse to them from a production machine.| Indicator | Role described by the researchers |
|---|---|
| mtrtb[.]com and subdomains | Primary ad serving and selective-delivery domain |
| adtimizer[.]co | Impression and click logging, linked by load balancer evidence |
| myweb3id[.]io | ID syncing with other ad vendors |
| tracookiepixel[.]xyz and cookie-sync[.]xyz | Cookie matching domains, reported suspended October 1 |
| controlium[.]net and powerium[.]net | Controlium platform and related services |
| myipinfo[.]io, akedo[.]gg, volasim[.]com, tekma-dmp[.]ai | Properties linked to the company that received much of its ad traffic |
| pagead.trustlayersdk[.]com | Command channel domain in the staged script kit analyzed by Confiant |
| discover-tech[.]io and mydsp[.]io | Corporate site and legacy DSP domain |
The Five Ps of Vendor Trust
The deeper fix is a better question to ask of every vendor in your consent configuration. We use a simple framework, the Five Ps, that goes beyond whether a vendor appears on a list.| P | Question | What good evidence looks like |
|---|---|---|
| Provenance | Who owns and controls this vendor, and for how long? | Corporate records, beneficial ownership information, board and shareholder history that match the vendor’s story |
| Purpose | Does its observable behavior match its stated business? | Real advertisers, real revenue and conversions, a customer base you can verify |
| Payload | What code does it actually run in our pages, apps and ad slots? | Network and script inspection, runtime monitoring and restrictions on what can read your cookies and storage |
| Proof | What independent evidence exists beyond a list entry? | Third-party audit results, security attestations and contractual audit rights |
| Pruning | How fast can we remove it, and do we need it at all? | A documented removal procedure, a minimum necessary vendor count and a periodic review |
Where Captain Compliance Fits, and Where It Does Not
We want to be precise about what a consent platform can and cannot do in an incident like this. No consent tool detects mercenary spyware inside a bid response, and no one should claim otherwise. Detecting a malicious creative in real time is the job of specialized ad security vendors, browser and operating system vendors, and the ad platforms themselves. What a consent and monitoring platform can do is shrink the surface and speed the response, which is exactly where most organizations are weakest.- Gate vendors behind real consent. Captain Compliance’s consent management platform, which carries IAB TCF validator certification and participates in the Google CMP Program, holds non-essential tags until a visitor opts in and honors Global Privacy Control signals. Fewer vendors firing before consent means fewer unknown parties reaching your visitors.
- See what actually loads. Continuous website monitoring and our Patrol privacy risk monitoring tool surface third-party domains and data flows as they appear, so a new cookie matching domain or an unexplained script is visible to your privacy team and not just to marketing.
- Make vendor removal a one-place decision. Managing vendors centrally means that when a vendor like Discover-Tech is suspended, you can disable it across your sites and document the change rather than chasing individual tag configurations.
- Keep disclosures accurate. Dynamic privacy policies and vendor disclosures reflect the vendors you actually use, which matters when a regulator or plaintiff compares your notice with your site.
- Produce the evidence. Timestamped consent records, scan histories and change logs give you a dated account of what was running and what you did about it, which is the record counsel will ask for first.
What Comes Next
- IAB Europe’s decision. The suspension stands until violations are remedied and verified, and further confirmation of the published findings could lead to expulsion. IAB Europe says it will monitor findings by competent authorities.
- Regulatory follow-up. Citizen Lab has called on regulators to investigate whether Discover-Tech and Candiru violated applicable laws. Because the researchers report ad impressions on European institutions and many national networks, expect questions from data protection and security authorities.
- More research. Citizen Lab says it will publish a separate report on the DARK CARTOGRAPHER activity once disclosures to mobile carriers are complete, and that its investigation of Discover-Tech is ongoing. Its visibility into Discover-Tech’s bidding data was limited to one platform and a limited time period, and did not include data from Beeswax or Eskimi.
- Industry reforms. Expect pressure on exchanges, demand-side platforms and trade bodies to add ownership screening, runtime creative inspection and faster takedown channels. Citizen Lab’s report includes recommendations for lawmakers, defenders and the advertising industry.
Frequently Asked Questions
What is AdFection?
AdFection is the name Citizen Lab gave to a technique in which a targeted online advertisement is used to deliver zero-click spyware. The ad contains a script that calls a server, which decides whether to send malicious code to a particular device. Citizen Lab describes its Al Jazeera findings as the first public technical confirmation of this attack in the wild. It is also to note that Al Jazeera is Qatar funded and is not a very reputable news source. For example Saudi Arabia is often attacked with fake hit pieces by Al Jazeera for political gain and not true journalism.Is Discover-Tech still on the IAB Europe Global Vendor List?
According to IAB Europe’s notice to TCF participants, Discover-Tech is suspended from the GVL following an audit that found violations of the TCF Policies. The suspension lasts until the violations are remedied and verified, and further confirmation of the researchers’ findings could justify permanent expulsion.Does being on the Global Vendor List mean a vendor is safe?
No. IAB Europe says it is not equipped or mandated to investigate conduct outside the substantive scope of the TCF. A listing shows that a vendor registered for the framework and agreed to its policies. It is not a security review or an ownership check, so vendor due diligence remains your responsibility.Was my website affected?
It depends on whether Discover-Tech demand ran on your inventory or its tags loaded on your pages. The researchers report impressions across tens of thousands of apps and websites in many countries, and an impression alone does not mean a visitor was targeted or infected. Check your vendor list, search for the published indicators and ask your ad partners in writing.What should publishers do right now?
Confirm that Discover-Tech is removed from your consent configuration, search logs for the published domains, ask supply-side partners whether the company’s demand ran on your inventory, harden cookie flags and ad rendering, and keep dated records of every step.Can a consent management platform stop spyware delivered through ads?
No. A consent platform can limit which vendors load before consent, make vendor changes fast and consistent and give you visibility and evidence. Detecting malicious creatives is the role of ad security tools and the ad platforms. The two work best together.Does the GDPR apply to a vendor like this?
The GDPR applies to processing of personal data of people in the EU regardless of where the processor is located, and publishers that place third-party code on their pages retain responsibilities for what happens through it. Whether any specific party violated the law is for regulators and courts to decide, and counsel should assess your particular situation.Where can I read the original research?
Citizen Lab’s Report 195, “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware,” and Confiant’s “ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming” were both published on October 15, 2026.Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
