Discover-Tech: an IAB-listed vendor placed booby-trapped ads in 75,000 apps
On 15 October 2026 the Citizen Lab at the University of Toronto published an investigation finding that Discover-Tech, an Israeli company listed since 2020 on IAB Europe’s TCF vendor list as vendor 778, acted as a bridge between programmatic advertising and mercenary spyware vendors: between March and June 2026 its ads carrying an attacker script were displayed in 75,373 Android and iOS apps, and, according to the researchers, devices at Al Jazeera were infected through the mere display of a targeted ad. IAB Europe suspended it from its list, which marks it deleted as of 8 October 2026, and said it is not equipped or mandated to investigate conduct outside the scope of the TCF. For an app publisher, the case is a reminder that a displayed ad makes the phone contact servers the publisher never chose, and that the vendor list its banner presents is a choice.
On 15 October 2026 the Citizen Lab, a research laboratory at the University of Toronto, published “Exposing AdFection”, released at the same time as an investigation by Confiant, a company specialising in online advertising security. The report concerns Discover-Tech, an Israeli company that presented itself as an advertising buying platform. According to the researchers, it actually served as a bridge between programmatic advertising and several mercenary spyware vendors, including Candiru, and they found no evidence of legitimate advertising activity. The Citizen Lab describes its report as the first technical demonstration of real-world infections by spyware delivered through targeted ads, with no click from the victim: it finds with high confidence that devices at the Al Jazeera network were targeted and infected this way, an attack it calls “AdFection”.
Apps are at the heart of the case. Between March and June 2026, Discover-Tech ads carrying an attacker script were displayed in 75,373 Android and iOS apps, and more than three quarters of its bids were for ad slots in apps. Since 2 July 2020 Discover-Tech had been listed, as vendor 778, on the Global Vendor List of the TCF, the consent framework of IAB Europe, the European online advertising association; the list marks it deleted as of 8 October 2026. For a publisher and its DPO, the case says three things that go beyond cybersecurity. An ad displayed in an app is code, which makes the phone contact servers the publisher did not choose. Being on the IAB’s list is no check of what a vendor does outside the TCF’s rules. And the vendor list a banner presents is the publisher’s choice.
An ad that calls its buyer
The starting point is the mechanism of any programmatic ad. When an ad slot is about to be shown, the code of the platform selling it, embedded in the app, gathers information about the device and its user and sends it to ad exchanges to solicit bids; this information can include, the Citizen Lab writes, device identifiers and characteristics, precise location and IP address, along with data about the app and the ad slot. It is the real-time bidding the Xandr decision described. The winning ad is not just an image: it can carry code from the advertiser, its buying platform or other parties, run in the app while the ad is displayed.
Discover-Tech turned that into a channel. A large number of its ads contained a script tag pointing to a server the company called a “NOAS server”. When rendered, the ad connected to it, submitted an advertising identifier, a cookie ID or the phone’s mobile ad ID, and executed whatever JavaScript came back. The server decided, apparently from the IP address and those identifiers, whether the device was a target; if not, it returned an empty response. Neither the malicious code nor any pointer to it passed through the companies that served and displayed the ads. Confiant publishes one of these calls, taken from an ad detected on 12 April 2026: the server address carries an identifier, an IPv4 address, the country (Belgium), the operating system (Android) and the device model, filled in by the bidder when the ad was served.
That is how these ads got past the checks. Eskimi, one of the buying platforms Discover-Tech used, explained it in its reply to the researchers: “the advertiser’s tags were built to evade automated scanning. They loaded different code depending on who was viewing the ad, including the device, IP address and location”, and campaigns were often restricted to very narrow IP target lists. Most of the time, according to the Citizen Lab, the person seeing the ad is not selected as a target and the server returns nothing; the ad has nonetheless already sent Discover-Tech what it gathered.
Everyday apps, mostly on Android
To measure the scale of the operation, the Citizen Lab analysed nearly four billion ad bidding records left publicly readable on a Discover-Tech server, those of its buying platform MyDSP. From March to June 2026, it bid on 3,770,286,576 impressions and appeared to win 441,954,291 of them, or 11.7%. More than three quarters of these bids, 76.7%, were for slots in mobile apps. At least 718,748,885 of them, about 19%, were to show an ad that, judging by its name, contained the tag calling the NOAS server.
These ads were displayed in 75,373 Android and iOS apps and on 120,768 websites, actual displays rather than mere bids, with fewer on iOS than on Android. The report lists messengers, email clients, video players, weather apps, language-learning apps, religious apps, health apps such as period trackers, dating apps and a large number of games. On the supply side, 67.4% of MyDSP’s bids went through Yandex’s ad exchange, 24.74% through Google Ad Manager and 7.24% through Vungle, Liftoff’s mobile ad exchange; Discover-Tech also bought through the Beeswax and Eskimi platforms, which these records do not cover.
An impression does not in itself confirm targeting or infection, the Citizen Lab stresses; it assesses that the impressions it found on sensitive networks would at minimum have resulted in profiling by Discover-Tech. Confiant, which puts Discover-Tech’s volume at around 10 million ad impressions a day, observed handoffs to Candiru’s infrastructure on only hundreds to low thousands of impressions a day, in nine countries; Belgium, the first target it observed on 12 April 2026, accounts for 56% of them, and the large majority of these ads were served on residential or mobile connections. At Al Jazeera, at least 45 devices were targeted in 2024 and 2025, and a Windows file isolated from one of the compromised devices helped tie the attack to Candiru.
Six years on the IAB’s list
Discover-Tech was not operating on the fringes of the system. The TCF’s Global Vendor List, from which consent management platforms build their banners, carried it from 2 July 2020 to 8 October 2026 as vendor 778. Its entry, still readable in version 183 of the list, published on 29 October with 1,036 active vendors, asks for consent for five purposes: store and/or access information on a device, use limited data to select advertising, create profiles for personalised advertising, use profiles to select personalised advertising, and measure advertising performance. It also declares that it identifies devices based on information transmitted automatically, that the data it collects include IP addresses, device identifiers and non-precise location data, and that it accesses the device by means other than cookies.
Google had also listed it, from 2020 to 2026 according to the Citizen Lab, among its certified external vendors for Ad Manager, among the ad technology providers that can receive data on website visitors and app users in Europe, and among its ads personalization providers. After the investigation, Google terminated its access to its ad exchange platforms, Beeswax removed it from its buying platform, Vungle paused its access while conducting its own review and Eskimi blocked its accounts and domains.
These listings, the Citizen Lab finds, “appear to be largely based on self-attestation by vendors”. The TCF Policies require IAB Europe to take reasonable steps to vet applications and to verify the identity of the parties controlling a vendor, while Discover-Tech’s links to figures in the spyware industry could, according to the researchers, be readily found in corporate records. They draw a direct consequence for consent: Discover-Tech’s inclusion “potentially means that, for almost six years, hundreds of millions of Europeans were presented with a consent request that, if the recipient clicked ‘Agree,’ could be construed as authorizing Discover-Tech to process their data under the GDPR.”
IAB Europe responded on 15 October. Discover-Tech is suspended from the list following an audit under the TCF Compliance Programmes, which identified violations of the TCF Policies; the suspension will remain until the violations are fully remedied and compliance has been verified, and further confirmation of the published findings could justify a definitive expulsion. The association adds that it is “not equipped or mandated to independently investigate conduct falling outside the substantive scope of the TCF”, and that it will monitor investigations by competent authorities. The framework itself was not foreign to the case: on the web, Discover-Tech’s tracking pixel processed TCF consent signals for itself, Xandr and Beeswax, and Confiant established that its data collection ran even where it lacked users’ consent under the GDPR.
A banner’s vendor list is a choice
Nothing in either report indicates that the publishers of the apps concerned had chosen Discover-Tech or knew what it was doing. The vendor list their banner presents, however, is theirs to decide. The TCF Policies, version 5.0.b, let a publisher choose the vendors for which it helps establish legal bases, and warn it to consider how many vendors it works with and to put a selection process in place: “Providing transparency and helping to establish Legal Bases within the Framework for an unjustifiably large number of Vendors may impact users’ ability to make informed choices and increase Publisher and Vendor legal risk.” A vendor the publisher does not disclose must appear in the signals as having no legal basis.
Google applies the same logic in AdMob, its ad platform for apps. Its EU user consent policy requires the publisher to identify each ad partner that receives the personal data of users in the European Economic Area, the United Kingdom and Switzerland, and the tool lets it select up to 700 of them. If the publisher leaves them alone, Google writes, “the commonly used set of ad partners will serve”, the set representing the most revenue to publishers. A banner that keeps the default list presents partners no one at the publisher chose one by one.
The CNIL, France’s data protection authority, expects the publisher to have a complete view of the actors involved in its processing, under Article 24(1) of the GDPR, as its recommendation on mobile apps sets out. A list of several hundred vendors accepted wholesale sits poorly with that requirement, and the Discover-Tech case shows what such a list lets through: being on the IAB’s list attests that a vendor was admitted to the framework and committed to its rules, not what it does with the data it receives.
After 8 October, what stays on the phones
Deleting a vendor follows precise rules. The list’s specification, published by IAB Tech Lab, states that a vendor whose entry carries a deletion date “is considered deleted after this date/time and MUST NOT be established to users”, and that vendor IDs are never reused. The list does not touch consent strings already stored, though. In an app, the user’s choice is kept on the phone, under the standard IABTCF_ keys, and it encodes, vendor by vendor, what the user accepted when the banner wrote it. A string written before 8 October can therefore still carry, at position 778, the consent given that day, until the app’s consent management platform regenerates it.
What has already been collected remains. The Citizen Lab urges competent authorities to investigate Discover-Tech and Candiru, and advises users to regularly reset their mobile advertising ID: it is one of the identifiers by which Controlium, Discover-Tech’s targeting platform, let its customers designate a target, alongside a cookie ID and the IP address.
What the case changes for an app
What leaves the phone when an ad is displayed is decided in a chain the publisher does not see, and the only place the publisher can observe it is the phone itself. It is also a revenue question. According to the MyDSP records, Discover-Tech spent about 109,000 dollars over four months, assuming, the researchers note, that costs are recorded in micro-dollars, for more than 440 million winning bids; Confiant found that in August 2026 about 60% of the ads running through Discover-Tech were affiliate placements, and that over a third of its ad spend promoted its own website. An app’s inventory can thus be sold to a buyer whose business is not advertising.
For a DPO, the case comes down to a few questions to ask at every version of an app that shows ads. Which ad platforms does it embed, and through which exchanges are its slots sold? Which servers does the phone contact when an ad is displayed, and what do they take away, from the advertising ID to the IP address and the device model? Was the list the banner presents chosen, or does it keep a default list? And does the consent string stored on the phone follow deletions from the IAB’s list?
These questions are answered on the phone. Skanopy automatically drives the Android app on a real phone, accepts or refuses in the banner as a user would, then records every third-party actor the phone contacts, including those a displayed ad makes it call, what each receives and when relative to the choice. It also reads the consent string the banner stores and compares it with the actors the app actually contacts, version after version. That is the whole point of a mobile app analysis: it does not state the law, it supplies the dated evidence the law is applied to.
Sources
Every finding in this article refers to one of these documents.
- Citizen Lab ’26Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary SpywareBill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, The Citizen Lab, 15 October 2026
- Confiant ’26ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity VacuumingConfiant, 15 October 2026
- IAB Europe ’26Recent Reports Concerning a TCF Vendor, Discover-TechIAB Europe, 15 October 2026
- GVL 183Global Vendor List, entry of vendor 778IAB Europe, version 183 of 29 October 2026
- TCF 5.0.bIAB Europe Transparency & Consent Framework Policies, Chapters III and IVIAB Europe, version 5.0.b
- IAB Tech LabConsent string and vendor list formats v2IAB Tech Lab, TCF specifications
- AdMobManage GDPR ad partnersGoogle AdMob Help
- CNIL ’25Recommendation on mobile applicationsCNIL, deliberation no. 2025-024 of 27 March 2025 (amended version published on 8 April 2025, in French)
Frequently asked questions
On 15 October 2026 the Citizen Lab at the University of Toronto and the company Confiant published two investigations into Discover-Tech, an Israeli company that presented itself as an advertising buying platform and that, according to the researchers, served as a bridge between programmatic advertising and mercenary spyware vendors, including Candiru. Its ads called a server that returned code only to the devices selected as targets; the Citizen Lab finds with high confidence that devices at Al Jazeera were infected this way, without any click. Between March and June 2026, these ads were displayed in 75,373 Android and iOS apps and on 120,768 websites. Google, IAB Europe and several advertising platforms have since cut off Discover-Tech’s access.
Yes. IAB Europe’s TCF Global Vendor List carried it from 2 July 2020 to 8 October 2026 as vendor 778, asking for consent to store and/or access information on a device and for personalised advertising, among other purposes. IAB Europe says it suspended Discover-Tech following an audit that identified violations of the TCF Policies, and that it is not equipped or mandated to investigate conduct falling outside the scope of the framework. Google also listed it among its ad technology providers until early October 2026.
Yes. IAB Europe’s TCF Policies, version 5.0.b, let the publisher choose the vendors for which it helps establish a legal basis, and urge it to put a selection process in place: an unjustifiably large number of vendors may impact users’ ability to make informed choices and increase its legal risk. In AdMob, a publisher can select up to 700 ad partners; if it does not use these controls, Google serves a commonly used set, the partners representing the most revenue to publishers.