New Delhi: An account on a digital advertising platform linked to the delivery of mercenary spyware logged in primarily from India, according to a new investigation by the University of Toronto’s Citizen Lab, which also found that a Dubai-based subsidiary of an advertising group with operations in India had acquired business assets from the Israeli company at the centre of the investigation.The account was one of several users of ‘Controlium’, a platform operated by Israeli advertising technology company Discover-Tech that allows customers to select individual users for profiling or infection through targeted advertisements.In its report published on Oct 15, Citizen Lab said it had extracted login records covering 128 days and identified 120 distinct usernames accessing Controlium. It said that one account identified as ‘mi19mos25a’ had “primarily logged in from India, and occasionally Israel”.However, it could not identify the entity behind the India-based account or establish what campaigns the account had configured.Separately, Citizen Lab’s report noted that Affle, an Indian-listed mobile advertising company, had acquired business assets from Discover-Tech in 2021.According to a January 26, 2021 filing by Affle (India) Limited to the Bombay Stock Exchange (BSE) and the National Stock Exchange (NSE), the acquisition was made through Dubai-based Affle MEA FZ-LLC, a subsidiary of Singapore-based Affle International Pte Ltd, which is wholly owned by Affle (India) Limited. Last year, Affle (India) Limited changed its name to Affle 3i Limited.The January 2021 filing said the acquired assets included Discover-Tech’s “technology platform, brand name, intellectual property rights, business relationships and technical information”. It set the fixed consideration at $1.15 million, with a maximum additional success fee of $3.37 million payable over a period of up to 4 years.In a press release issued on January 27, 2021, Affle announced the global launch of its Appnext Out of Box Experience (OOBE) platform, describing it as “powered by the acquisition of Business Assets of DiscoverTech Limited”.Discover-Tech’s then chief executive, Dekel Boni, was quoted in the release as saying, “Our technology powers the first interaction a user has with his new device, upon activation, and we are proud to become a part of Appnext’s complete app discovery offering.”Citizen Lab said it had no reason to believe Affle had control over Discover-Tech’s malicious advertising operations. “Based on the information available to us, we believe that Discover-Tech Ltd sold its offerings for mobile carriers and device vendors examined in the previous subsection (of the report), to Affle,” the researchers wrote, adding that “the exact scope of this asset sale remains unknown to us”. Affle did not respond to Citizen Lab’s request for comment within the timeline provided. The Wire has also sent queries to Affle seeking clarification on the scope of the acquisition, its relationship with Discover-Tech’s activities documented by Citizen Lab and whether the acquired assets had any connection to Controlium. The company had not responded at the time of publication.The Citizen Lab investigation found that Discover-Tech had facilitated the delivery of Candiru spyware to devices at international news network Al Jazeera in 2024 and 2025. The researchers said they had found that at least 45 devices within the news organisation were targeted and infected through the advertising system.The report names the technique as “AdFection”, with Citizen Lab describing it the “first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads”.A zero-click attack does not require a person to click a link, download a file or otherwise interact with an advertisement. Instead, code embedded in an advertisement can connect to the operator’s servers when the ad is displayed, allowing a device to be profiled and, if selected, potentially infected.The report noted that “the simple display of a targeted ad is enough for infection”. The Cyber surveillance watchdog said Discover-Tech operated Controlium as a platform that allowed customers to identify individual devices for targeting. In describing its capabilities, the researchers wrote, “Controlium allows malicious actors to precisely profile and de-anonymise millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.”They claimed that while there had been reporting on the intersection of spyware and advertising, “the specific ways mercenary spyware companies plug into the ads ecosystem to target particular users have remained largely secret”. Its investigation traces the technical connections between Discover-Tech’s advertising infrastructure and spyware attributed to Candiru, an Israeli surveillance company that has since been rebranded as Integrity Labs.The researchers described Discover-Tech as appearing to be “a front for large-scale ad espionage abuse”.“The company serves as a bridge between ad vendors and the mercenary spyware ecosystem. In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose,” the report said.The investigation began after Al Jazeera’s internal technical team noticed unusual network activity in 2024, with similar patterns continuing in 2025. After the organisation shared network logs with Citizen Lab, the researchers traced a sequence of connections from Discover-Tech’s advertising infrastructure to a Candiru validation server and then to a command-and-control server. Their analysis linked the activity to Candiru’s spyware “with high confidence”.Candiru, along with Pegasus spyware vendor NSO, had been blacklisted by US Commerce Department in 2021 “The researchers also found that an advertisement could collect information even when the person viewing it was not selected for infection. “Nevertheless, the ad will still gather data from the user’s browser and submit it back to Discover-Tech,” the report said. This could include cookies associated with the webpage and the device’s public IPv6 address.Citizen Lab examined nearly 4 billion advertising-bidding records made publicly accessible on a Discover-Tech website. Its analysis found that between March and June 2026, Discover-Tech’s MyDSP platform bid on approximately 3.77 billion advertising impressions and won about 442 million. Of those bids, 718.7 million, or around 19%, related to advertisements that appeared to contain scripts pointing to a server used in the delivery mechanism.The researchers found that advertisements carrying the scripts were displayed in 75,373 Android and iOS apps and on 120,768 websites. These were actual ad impressions rather than bids that may not have resulted in an advertisement being shown.More than 1 million such advertisements appeared on each of MX Player and Lark Player. Viber displayed more than 700,000 on Android, while Snap VPN, Truecaller and VivaCut each showed around half a million. The popular Ludo STAR game also carried the advertisements. Citizen Lab did not provide a country-by-country breakdown for the individual apps.The advertisements appeared on a range of other applications, including email and browser apps, weather services, learning platforms, religious apps, health and period-tracking apps, and games. On websites, more than 100,000 such advertisements appeared on sites in Montenegro, Yemen and Pakistan, including Pakistani technology site WhatMobile.The bidding records showed that Yemen had the highest number of bids for advertisements containing the relevant scripts, at approximately 457 million, followed by Pakistan with about 139 million and Montenegro with nearly 98 million. These figures refer to bids for the advertisements, rather than the number of infections. Incidentally, the Citizen Lab report had noted that one Controlium user, “Pindi”, logged in only from Pakistan.The researchers also identified advertisements on government-operated networks in Bhutan and several other countries. Their findings included impressions on networks associated with government, defence, foreign affairs and security bodies, as well as media organisations and critical infrastructure.Citizen Lab cautioned that an advertisement appearing on a government network did not by itself establish that a particular official had been selected for infection. The researchers said the impressions indicated that user devices on those networks could have been profiled and, in some cases, potentially exposed to further code.A complementary investigation by advertising-security company Confiant, published alongside the Citizen Lab report, examined Discover-Tech’s advertising activity and technical infrastructure. Its report described Discover-Tech as an unusual operation within the advertising industry.Confiant’s analysis found that Discover-Tech’s cookie-matching infrastructure generated what it described as “billions of audience touch-points per month over tens of thousands of websites”, creating a large dataset of IP addresses, browser user agents and advertising technology identifiers. Such information can help link activity across different websites and advertising systems.The company observed Discover-Tech advertisements in 228 countries and estimated that the operation served around 10 million ad impressions per day. Palestine was the most heavily targeted geography in its dataset, accounting for 1.9% of all advertisements observed and peaking at 9.9% on April 7. On Android, one in every 36 advertising impressions in Palestine during the observation period was served by Discover-Tech.Confiant however, cautioned against treating advertisements appearing on institutional networks as proof that particular officials were targeted. “Being reached on one of these networks does not by itself mean an individual was targeted,” it said. “An ASN identifies an organisation’s network, not a person, and the user may have been on a guest connection or a shared exit point.”Citizen Lab found that Discover-Tech had appeared on lists of “certified” and “approved” advertising vendors maintained by Google and IAB Europe between 2020 and 2026. The researchers said these listings helped the company appear legitimate and participate in the wider advertising ecosystem.Google, which collaborated with Citizen Lab, terminated Discover-Tech’s access to its advertising-exchange platforms in early October 2026. IAB Europe suspended the company from its vendor registry. Beeswax removed Discover-Tech from its ad-buying platform, Vungle, owned by Liftoff, paused the company’s access while reviewing the findings, and Eskimi blocked its accounts and domains.