A recent report by the Citizen Lab research group revealed that a digital advertising company, Discover-Tech, delivered malicious advertisements that exploited unpatched software flaws to install spyware without any user interaction. The findings, published on Thursday, indicate that the company’s ad network was used to distribute zero-click exploits tied to mercenary-grade surveillance tools.

The investigation identified Discover-Tech as a vendor certified by major industry platforms, including Google and IAB Europe. The firm leveraged consent mechanisms under the European General Data Protection Regulation to target users across the European Union. Its advertisements were distributed through prominent ad networks such as Google, Yandex, and Beeswax.

Following the report’s release, Google and IAB Europe removed Discover-Tech from their vendor registries. Google also cut off the company’s access to its ad exchange infrastructure. Beeswax eliminated its integration, while Vungle (operating under the Liftoff brand) suspended the company pending review. Eskimi similarly blocked Discover-Tech’s accounts and associated domains.

According to the report, ads served by Discover-Tech appeared on networks linked to government and national security institutions worldwide, including NATO, United Nations systems, European legislative bodies, critical infrastructure operators in Australia, and military and public agencies in Norway and Sweden.

Citizen Lab described the campaign as a systemic failure of the digital advertising ecosystem, noting that the infrastructure enabled mass privacy violations and facilitated the delivery of spyware developed by Candiru, an Israeli firm later rebranded as Integrity Labs. Under the arrangement, ads targeted individuals matching specific profiles of interest to Candiru’s clients. When these ads loaded on a device, embedded code triggered a connection to Candiru’s command servers, which then delivered exploit payloads designed to install surveillance malware without user consent.

The report does not specify the technical vulnerabilities exploited or the exact malware families deployed. However, Citizen Lab indicated that the exploits used were likely previously unknown flaws that had since been patched after the campaign was uncovered. The research group has not commented on the matter, and attempts to contact Discover-Tech and Candiru for response went unanswered.

In its recommendations, Citizen Lab urged advertisers, regulators, and platform operators to strengthen oversight of ad delivery systems to prevent abuse. The group also suggested that end users mitigate risk by using ad-blocking tools, limiting personalized ad tracking on mobile devices, and ensuring software updates are applied promptly.