Programmatic advertising has a new worst-case scenario. Researchers say a display ad needed no click to deliver mercenary spyware, and the vendor involved sat on Google and IAB Europe approval lists for almost six years.
A listed vendor, removed
Google and IAB Europe removed Israeli ad company Discover-Tech from their vendor registries in early October 2026. The removals came as a University of Toronto Citizen Lab report, published October 15, detailed that ads bought through Discover-Tech delivered Candiru spyware to at least 45 devices at Al Jazeera during 2024 and 2025.
Discover-Tech had been listed on the IAB Europe Global Vendor List since July 2020 and on Google’s vendor lists later that year. Those listings helped its ads reach legitimate inventory across tens of thousands of apps and websites.
Zero clicks, real infections
Most malvertising depends on a click or a download. Citizen Lab calls the new technique AdFection and says a targeted ad’s display was enough. When the ad rendered, it called back to a Discover-Tech server. The server then decided whether the viewer was selected. Targets received code, while everyone else received no payload.
That design kept malicious code away from the ad platforms and publishers that served the ad. The creative could look completely ordinary until the server response arrived.
The scale marketers should see
Between March and June 2026, Discover-Tech’s MyDSP bid on 3.77 billion impressions and won around 11.7%, according to the report. Ads carrying the relevant script made up about 19% of bids. Those ads were displayed in more than 75,000 Android and iOS apps and on 120,768 websites, including mainstream names such as Viber, Duolingo, Yahoo Mail, Weather.com and, in smaller volumes, BBC.com and The New York Times.
That is not a publisher failure. The ads arrived through standard programmatic pipes, which is exactly why media buyers should pay attention.
Approval is not security
IAB Europe says it takes reasonable steps to vet vendors, including who controls them. Citizen Lab argues that Discover-Tech’s spyware-industry links were visible in corporate records. Eric Banoun, a figure Haaretz has described as a pioneer of offensive cyber in Israel, sat on Discover-Tech’s board from 2020 until January 2025, according to Israeli company records cited in the report.
Google’s Certified External Vendors list requires a business review, but the report notes that the nature of that review is not specified. For marketers, vendor lists mostly answer consent questions, not security questions.
Audit before your next campaign
- Check your programmatic vendors on Google and IAB Europe lists, and note when they were added.
- Treat vendor approval as a consent signal, not a security guarantee.
- Review ownership, board records and business relationships for ad tech partners.
- Escalate partners with zero conversions, generic creative or thin advertiser data.
- Ask where your impressions actually run, including long-tail apps.
Citizen Lab’s report found little evidence of legitimate demand. MyDSP logged about $109,091 in spend over four months, with conversions always at zero. The practical takeaway for media buyers: map your programmatic supply chain before someone else maps it for you.
Source: PPC Land
