We reviewed ads for the major advertiser on this list that could hypothetically be a real external advertiser, “AliExpress.” The ads all appear to be a generic image that says “SALE” and shows a picture of miscellaneous products from Ugreen, a Chinese consumer electronics company.

We note that the landing page of some of the AliExpress ads is an AliExpress affiliate link.

https://s.click.aliexpress[.]com/e/_c3U5aNwL

https://s.click.aliexpress[.]com/e/_c3U5aNwL

We have no evidence of a business relationship between Discover-Tech and AliExpress and/or Ugreen, and we think the generic nature of the advertising content, the lack of any revenue recorded, and the lack of any conversion data recorded suggest these ads were likely not purchased on behalf of AliExpress or Ugreen.

Normally, a DSP would aim to earn money by selling ads to entities seeking to advertise goods and services. In this case, there is no good evidence that Discover-Tech’s MyDSP is earning money in this way.

Evidence of Ads With Attacker Script Tags

The MyDSP data shows that at least 718,748,885 of the bids (about 19%), were to show ads that apparently contained a script tag pointing to a NOAS server. We believe that the NOAS server is, generally, tasked to return some JavaScript exactly once to specific mobile ad ID and/or browser/cookie ID values, and subsequent visits return nothing until re-tasking.

We assessed whether an ad was likely to contain such a script tag by searching for ads whose name included the strings “infi” (a reference to Controlium’s “Infinite FIFO” feature), “NOAS”, “ppv2”, and “pqv2”. The “ppv2” and “pqv2” strings appear to be references to a newer version of the “Infinite FIFO” feature exposed as “Authenticator Manager” in the Controlium UI. We suspect that “pqv2” is for testing and/or QA, whereas “ppv2” is for production.

MyDSP submitted bids to show these NOAS ads to users with IP addresses that geolocate to 161 countries. It is important to note that IP geolocation can be inaccurate due to the use of satellite providers, VPNs, or other reasons. 

Looking at the full bidding data, without considering whether ad auctions were won, MyDSP also made a significant number of bids (> 10 million) on ad impressions geolocated to Russia, Indonesia, United Arab Emirates, Australia, United States, Sweden, Norway, Netherlands, Germany, Malaysia, and Cuba. However, we note that the Netherlands, Germany, and United States geolocation appeared to primarily be from VPNs or server IPs in these countries.

Apps and Websites That Displayed the Ads

Ads with attacker script tags were shown to users of 75,373 different Android and iOS apps and to visitors of 120,768 different websites in mobile and desktop browsers. These numbers refer to ads actually displayed to users of apps and websites rather than raw bids.

Android apps that displayed more than one million of those ads include MX Player and Lark Player:Music Player & MP3. The messenger Viber showed more than 700,000. The apps Snap VPN, Truecaller, and VivaCut – AI Video Editor displayed around half a million. The ads were deployed in email apps like Yahoo Mail, browser apps like Opera Mini, weather apps like German Wetter Online, learning apps like Duolingo, religious apps like WeMuslim, health apps like Period Calendar Period Tracker and in a large number of games like Bubble Shooter and Ludo STAR. Lower numbers of ads in the thousands were shown in family tracking apps like Location Share and in dating apps like Badoo and Grindr.

iOS apps deployed fewer of those ads than Android apps. The messenger Viber, which ranks second on iOS, showed only around 200,000 ads as compared to around 700,000 on Android. Still, the ads were displayed across a similarly wide range of iOS apps.

As discussed above, Discover-Tech’s ad targeting appears to focus on mobile apps. Only 23.3% of the bids we analyzed were for ad impressions in the web browser. Websites that displayed more than one million ads with attacker ad scripts include news publications from Armenia (mamul.am) and Serbia (kurir.rs). More than 100,000 of those ads were shown on news publications and other popular sites from Montenegro (dan.co.me, vijesti.me), Yemen (adngad.net), and Pakistan (whatmobile.com.pk). The site Weather.com displayed around 400,000. Larger numbers of ads were also shown on yahoo.com, AccuWeather.com, tripadvisor.com, yandex.ru, and news sites in Denmark (bt.dk), Bosnia (slobodna-bosna.ba), Egypt (almasryalyoum.com), and Kazakhstan (vesti.kz). The long tail of websites that deployed those ads included everything from 9gag.com and foxnews.com to bbc.com, cbc.ca, haaretz.co.il, and nytimes.com.

Ad Impression Data Highlights Systemic Risk

Our review of the ad bidding data indicates that Discover-Tech ads were shown on devices in national-security-sensitive networks around the world. These include the networks of various ministries of defense, armed forces, national cyber agencies, intergovernmental organizations and multilateral security organizations including NATO, and networks associated with critical infrastructure. The data also show impressions from the networks of media organizations around the world. At minimum, we assess that these ad impressions would have resulted in profiling by Discover-Tech. In some cases, the impressions could have resulted in code from Candiru or other entities running on the user’s device. 

A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.  However, the fact that Discover-Tech was able to bid on and show ads on these networks highlights the systemic risk posed by AdFection and the advertising ecosystem, and warrants urgent investigation to determine whether any users on these networks were infected with spyware. We also note that our visibility into Discover-Tech’s impressions is confined to the data on Discover-Tech’s MyDSP platform.  This data does not include data from Beeswax and Eskimi, and covers a limited time period. This incompleteness further reinforces the need for follow-up investigation. 

NATO and the United Nations

We identified impressions in NATO and United Nations networks. 

European Union Entities

In Europe, we identified impressions from the networks of the European Parliament, the European Commission, and the Council of the European Union’s General Secretariat. 

Nordic Government & Critical infrastructure Clusters

We identified widespread impressions in Nordic states, including Denmark, Norway and Sweden. We assess that this cluster warrants close scrutiny, and note some of the more concerning findings:

• In Norway, Discover-Tech ads were shown to users on the networks of the legislature (Stortinget), the Norwegian Digital Agency (Digitaliseringsdirektoratet), the Norwegian Communications Authority (Nasjonal kommunikasjonsmyndighet), state IT networks (Statens IT), the Norwegian Police (Politiets It-enhet) and serious crime units (Kripos), among many others. Notably, we also identified impressions in multiple county and municipal networks across northern Norway, including near key military installations (e.g. Alta, Harstad, Nordland).
  
• In Sweden, Discover-Tech ads were shown to users on the networks of the Armed Forces, the national grid operator (Svenska Kraftnat), the state owned power company (Vattenfall AB), the national internet exchange (Netnod AB), defense contractor Saab, Volvo Group, university networks including the Chalmers University of Technology, national research funding bodies (Verket for Innovationssystem), and Sweden’s national Meteorological and Hydrological Institute (Sveriges Meteorologiska och Hydrologiska Institut).
• In Denmark, Discover-Tech ads were shown to users at the national rail network (Banedanmark), the national post (Post Danmark), Denmark’s National Research and Education Network (Forskningsnettet), alongside multiple municipal and regional government networks and public health authorities. They were also shown on networks at Denmark’s digital infrastructure company KMD A/S, renewable energy sector firms such as Vestas Wind Systems and Ørsted, Grundfos, banks including Den Danske Bank, and Copenhagen Airports.

Australia: Critical Infrastructure, Government & University Networks

The ad impression data also reveal a substantial cluster of impressions in Australia, including on government and private-sector networks associated with critical infrastructure sectors like grid and power companies, as well as networks associated with universities and research centres, including entities working on nuclear research, like the Australian Synchrotron, and the Australian Nuclear Science and Technology Organisation.

Governmental Targets: A Global List

Numerous other geographically distinct clusters of widespread impressions appear among the data. Many of these impressions occurred in defense, foreign affairs, internal affairs, or security bodies. Table 6 provides examples of the government networks where we found Discover-Tech impressions.

Our investigation is ongoing. As of now, we have identified impressions in government-operated networks in the following countries:

• Armenia (including the Office of the Prime Minister)
• Australia
• Azerbaijan
• Bhutan
• Brazil
• Czechia
• Denmark
• Indonesia
• Israel 
• Italy 
• Kosovo
• Libya
• Malaysia
• Mexico
• Montenegro
• Norway
• Pakistan
• Russia
• Somalia
• Sweden
• Thailand
• The United Arab Emirates
• The United States (American Samoa)
• Uruguay

We also found impressions on the networks of election oversight bodies in Armenia, Indonesia, and Mexico.

Chips & Semiconductors: from research to fabrication

We found what appears to be a nexus among the advanced semiconductor industry, covering the chain from design, memory, to chip development and fabrication, with the greatest number of impressions seen in Intel networks, alongside Nvidia, Sandisk, Texas Instruments, Broadcom, Micron Technology, and ARM. We also identify numerous research entities in this category like IMEC. We also identified impressions within the networks of large U.S. tech firms including Apple, Microsoft, and Motorola.

We also identified impressions in specifically defense-sector tech entities, including Raytheon (U.S.) and Elbit Systems LTD (Israel), and the nuclear sector, including the Westinghouse Electric Company (U.S.).

Global Media Organizations

Given our identification of zero-click attacks against Al Jazeera, we scrutinized bidding records for impressions within the networks of media organizations. We found many. Often, these included the largest media organizations in a particular country, as well as public broadcasters and media conglomerates. The countries (with a count of institutions) include:

• Australia: 3
• Denmark: 3  
• France: 1  
• Mexico: 2  
• Israel: 3  
• Italy: 2
• Norway: 2 
• Sweden: 3  

We also identified impressions within the networks of international media services. Our investigations into these cases are ongoing.

Confiant’s Findings Underscore Dangers of AdFection

The researchers at Confiant analyzed targeting data and found signs that these ads were displayed on networks of major governmental entities, including the U.S. Department of Defense, the Dutch Ministry of Economic Affairs, Estonia’s Information System Authority (RIA), Spain’s Ministry for Digital Transformation and Civil Service, Armenia’s Office of the Prime Minister, and multiple government entities in Israel. Their research also found signs they were shown in networks of the International Atomic Energy Agency (IAEA) and the International Criminal Court.

6. How Discover-Tech Deploys Ads in the Browser

In this section we show how, beyond targeting users of mobile apps, Discover-Tech deploys a range of techniques to deliver ads and track users while they browse across websites. This involves Discover-Tech running its own code in the user’s web browser, both while deploying ads to users and independently of showing them ads. We explore Discover-Tech’s “Banner Tester” tool to show how the company generates tracking tags and pixels attached to ads, including code that connects to a NOAS server, which we identified as a vector for spyware delivery. We also document how Discover-Tech engages in “ID syncing” with other ad vendors, and how it leverages IAB Europe’s “Transparency and Consent Framework” to appear GDPR-compliant, even while facilitating unwanted and malicious activity.

An ad displayed to a website visitor consists of an image or video to be shown and a link to be clicked, but can also carry HTML and JavaScript code that connects to one or more domains in order to track users, ad impressions, clicks, and other activities. This code is typically referred to as an ad tag. A related concept, a so-called tracking pixel, also describes code running in the web browser that connects to third-party ad vendors. Ad vendors use additional tracking code for user ID syncing by exchanging user identifiers with each other in order to identify, profile, and target website visitors across sites and vendors.

Our analysis of ad tags, tracking pixels, and ID syncing activities associated with Discover-Tech’s ad delivery is based on an analysis of publicly available code, browser testing and ad transactions archived by the web investigation tool urlscan. While ads displayed in mobile apps similarly carry code that connects to ad vendors, this section focuses on Discover-Tech ads displayed in the web browser.

Discover-Tech’s Ad and Tracking Tags

We found two versions of another app related to Discover-Tech’s Controlium platform named “Banner Tester” published on the sites bt.myweb3id[.]io and bt.platc-tester[.]com. The apps provide the ability to generate and preview tags for banner ad campaigns in the browser.

The generated tags contain an ad creative and a link, which appear to serve testing purposes:

<a href='https://s.click.aliexpress.com/e/_DFudZEL' target='_blank' onClick='clicker();'><img src='https://cloud-images.s3.eu-west-1.amazonaws.com/MyDSP_Beeswax/Ali_rt_shop/320x50_1.png' id='222233'></a>

<a href='https://s.click.aliexpress.com/e/_DFudZEL' target='_blank' onClick='clicker();'><img src='https://cloud-images.s3.eu-west-1.amazonaws.com/MyDSP_Beeswax/Ali_rt_shop/320x50_1.png' id='222233'></a>

The tags contain additional HTML and JavaScript code that is prepared to make a number of requests to different URLs, including NOAS URLs and URLs for ad impression and click tracking. One version of the app generates tags for the “Target” platforms “Default” or “Mini Platform C”. The other version can generate tags for production, staging and testing environments, according to its source code. The generated ad tag URLs differ depending on the chosen options.

As the impression and click logging URLs generated by the app contain the parameter “dsp=BW”, we assume that these ad tags are designed to be deployed via the DSP Beeswax.

Several records archived on urlscan show examples of how Discover-Tech actually deployed very similar ad and tracking tags during visits to websites:

• During a visit to the Russian literature website livelib[.]ru in May 2025, Discover-Tech delivered an Akedo ad via its ad system MyDSP and Yandex, including requests to noas.mtrtb[.]com and dtech.adtimizer[.]co (urlscan).
• During a visit to nbcnews[.]com in August 2025, Discover-Tech delivered an Akedo ad via its ad system MyDSP and Google, including requests to tracker.mtrtb[.]com and dtech.adtimizer[.]com (urlscan).
• During a visit to a Spanish-language horoscope site in July 2025, Discover-Tech delivered a MyIPInfo ad via Beeswax DSP and Google, including requests to infinoas.mtrtb[.]com and dtech.adtimizer[.]co (urlscan).

User ID Syncing with Other Ad Vendors

Unlike apps on mobile devices, web browsers do not allow websites to access a universal device identifier. The process of “ID syncing”, often also referred to as “cookie syncing”, addresses this lack of a universal user identifier. Research shows that digital advertising firms and data brokers use sophisticated forms of ID syncing to identify, profile and target web users across vendors. They achieve this by constantly exchanging user identifiers with each other, storing them in the browser and retrieving them again while users visit different websites that embed third-party tracking code.

We found evidence showing how Discover-Tech engages in ID syncing with Comcast’s ad system Beeswax, Yandex, and Microsoft’s ad platform Xandr.

Discover-Tech appears to use its myweb3id[.]io domain for ID syncing with Yandex. This domain is highly prevalent as a tracking domain on a large number of websites. Starting in May 2025, urlscan archived more than 10,000 records that include third-party requests to the domain events.myweb3id[.]io, most of them occurring during visits to Russian websites.

A recent urlscan record shows an example of a typical request chain that involves ID syncing across Discover-Tech’s events.myweb3id[.]io domain and the following Yandex endpoint:

an.yandex.ru/mapuid/discovertechis

an.yandex.ru/mapuid/discovertechis

The URL component “discovertechis” indicates some kind of business relationship between Discover-Tech and Yandex.

Discover-Tech appears to use another domain, tracookiepixel[.]xyz, which is associated with myweb3id[.]io via DNS links and which is also highly prevalent as a tracking domain on a large number of websites, for ID syncing with Beeswax. Starting in July 2025, urlscan archived more than 10,000 records that include third-party requests to tracookiepixel[.]xyz, many of them occurring during visits to popular websites including IMDb and New York Times.

A recent urlscan record shows an example request chain that was initiated during a visit to the website of The Guardian, which involves ID syncing across Discover-Tech’s tracookiepixel[.]xyz domain and Beeswax’ tracking domain bidr[.]io. The requests contain the parameter “bee_sync_partners=dtech”, which indicates some kind of business relationship between Discover-Tech and Beeswax.

These ID syncing activities typically take place during website visits even when a user was not served a Discover-Tech ad. We are unsure how exactly Discover-Tech uses its browser ID syncing capabilities. Generally, being able to synchronize and correlate user identities across vendors is considered a precondition for individual-level ad targeting in the web browser. The Controlium platform, as examined in Section 3, offers to upload lists of Beeswax identifiers for ad targeting in its “cTargeting” module, among mobile advertising IDs, IP addresses, and other identifiers, based on our analysis of the source code.

We conclude that many websites make constant requests to Discover-Tech’s domains events.myweb3id[.]io and tracookiepixel[.]xyz in the background. These requests serve the purpose of ID syncing with Beeswax and Yandex, and Discover-Tech’s domains receive, in addition to user identifiers, at least the website visitor’s IP address and information about their browser and operating system.

Discover-Tech’s Tracking Pixel

Separately from Discover-Tech’s large-scale ID syncing on many websites, we found JavaScript code for a “tracking pixel” that was loaded during recent visits to only a few sites including myipinfo[.]io, cookiesurfer[.]com, and Discover-Tech’s corporate website, discover-tech[.]io (all three archived on urlscan).

These sites loaded versions of the tracking pixel code, both broadly similar, from the following URLs:

js.tracookiepixel.xyz/myipinfo/c_tracking_pixel_gdpr.js
js.tracookiepixel.xyz/dt/c_tracking_pixel_gdpr_enhanced.js

js.tracookiepixel.xyz/myipinfo/c_tracking_pixel_gdpr.js
js.tracookiepixel.xyz/dt/c_tracking_pixel_gdpr_enhanced.js

Based on our analysis of the source code, the tracking pixel serves the purpose of storing, retrieving and synchronizing user identifiers across Discover-Tech, Beeswax, Xandr, and Yandex. Once loaded on a website, the code stores user identifiers associated with Discover-Tech, Beeswax, and Xandr in the user’s web browser in order to retrieve them again during subsequent visits to websites that load the same code.

The code is designed to initiate the ID syncing process by sending Discover-Tech’s user identifier to Beeswax and Yandex in order to receive corresponding Beeswax and Yandex identifiers. Additionally, the code retrieves the user’s Xandr identifier. Request chains archived on urlscan show Discover-Tech’s tracking pixel in operation, including ID syncing with Yandex and the retrieval of user identifiers from Beeswax and Xandr.

When the tracking pixel code detects that a website visitor is located in a region where the GDPR applies, based on geolocating the user’s IP address, it uses IAB Europe’s Transparency and Consent Framework (TCF) to process user “consent” signals for the three TCF vendors Discover-Tech Ltd, Xandr Inc, and BeeswaxIO Corporation. This demonstrates how Discover-Tech utilizes its listing as a registered and approved ad vendor by IAB Europe, as discussed in Section 9.

The code also clearly maps the acronym “ZUID” to Xandr’s user identifier. As detailed in Section 4, several Controlium modules refer to an option labeled “Detect ZUID”. We are unsure how Discover-Tech’s Controlium platform exactly utilizes this identifier. As the “Detect ZUID” option is among a few “Add Ons” that can be activated when setting up an ad campaign, it may serve the retrieval of Xandr user identifiers either for ad targeting or for tracking targets. Xandr (Microsoft Advertising) did not respond to our request for comment within the timeline provided.

Generally, the purpose of Discover-Tech’s tracking pixel is unclear. As a large share of Discover-Tech ads are designed to lead users to the site myipinfo[.]io when clicking on those ads, the tracking pixel loaded during the site visit then correlates a target’s Discover-Tech user identifier with their Beeswax, Xandr, and Yandex identifiers.

Records archived on urlscan show that the MyIPInfo website loaded a version of the tracking pixel from another domain associated with Discover-Tech in the past:

js.cookie-sync.xyz/myipinfo/c_tracking_pixel_gdpr.js

js.cookie-sync.xyz/myipinfo/c_tracking_pixel_gdpr.js

7. Discover-Tech and Its Corporate Network

Discover-Tech has been deeply embedded and interconnected with the digital advertising industry for years. In this section, we further investigate Discover-Tech, key persons affiliated with the company, related companies, and the origins of its MyDSP advertising technology.

Adtech with a Background in Spytech

Discover-Tech purports to be a typical digital advertising firm, offering a so-called Demand-Side Platform (DSP), which facilitates the delivery of targeted ads. On its website, it claims to have “unrestricted access to top-ranking apps with 1+ billion daily active users” via a “worldwide ad exchange”. In addition to its DSP, Discover-Tech offers “monetization” solutions to mobile network operators and mobile device manufacturers, which we discuss further below.

Israeli company records we reviewed link Discover-Tech’s website, discover-tech[.]io, to the company Discover-Tech Ltd registered in March 2020, with Dekel Boni listed as its initial director and sole shareholder. In the two months after its incorporation, Eric Banoun, who is a major figure in the Israeli surveillance technology industry, joined Discover-Tech’s board of directors, and the shareholder base was expanded. From April 2020, the company’s shareholders included Dekel Boni, Guy Lants, Yaniv Basil, Zfanya Leib, Sergei Bartashevich, and Chaia Services Ltd, a company registered in the British Virgin Islands. Eric Banoun left the company’s board of directors in January 2025 and Chaia Services Ltd ceased to be a shareholder in March 2026. As of July 2026, Discover-Tech is directed by Dekel Boni and owned by Boni, Basil, and Lants.

Eric Banoun co-founded the cyberespionage firm Circles, a close NSO Group affiliate, and Senpai Technologies, which is part of the Intellexa consortium. We could not access corporate registration information on Discover-Tech’s shareholder Chaia Services Ltd. However, a Haaretz investigation reported that one of Chaia’s directors was Sara Hamou. Hamou managed Intellexa’s corporate network and was sentenced to eight years in prison (pending appeal) by a Greek court for her role in the Predatorgate scandal. Eric Banoun was listed as a director of a similarly named U.S.-based company, Chaia Services Tech LLC, which was dissolved in 2025.

Based on the links to Eric Banoun and Chaia Services Ltd., we conclude that Discover-Tech was linked to the spyware industry for almost six years, according to Israeli company records and other publicly available information.

Discover-Tech’s other shareholders, including Dekel Boni who is now the company’s sole director, have a background in digital advertising, previously working for adtech firms like Digital Turbine and Taptica, according to their LinkedIn profiles.³ Boni lists himself as Discover-Tech’s CEO, Guy Lants as its “Director of Product”. Yaniv Basil lists himself as the company’s “Chief Technology Officer” between 2020 and 2023.

Ad Vendor Registrations with Google and IAB Europe

Despite information about Discover-Tech’s links to figures in the spyware industry that could be readily obtained from a review of corporate records, major advertising industry organizations added the company to several lists of “certified” or “approved” ad vendors, which helped make the company appear to be a legitimate advertising firm and facilitated its participation in the advertising ecosystem at scale.

As discussed in Section 9, Google listed Discover-Tech among its “Ad Manager Certified External Vendors”, “Ad Technology Partners”, and “Ads Personalization Providers” from 2020 until 2026. The advertising industry association IAB Europe listed the company on the “Global Vendor List” for its “Transparency & Consent Framework” (TCF), also from 2020 until 2026. In Section 9, we examine the implications of Discover-Tech’s ad vendor registrations with Google and IAB Europe in detail.

Both the Google and IAB vendor registrations consistently refer to the Israeli company Discover-Tech Ltd and the domain discover-tech[.]io. In addition, Google’s list of “Ads Personalization providers” clearly links Discover-Tech to the domains  mtrtb[.]com and mydsp[.]io, which it listed among “domains which can be attributed to the provider” Discover-Tech Ltd.

Tracing the Origins of Discover-Tech’s MyDSP Advertising Tech

As discussed in Section 5, the domain mtrtb[.]com and the ad system MyDSP (mydsp[.]io) play key roles in Discover-Tech’s ad targeting.

According to historical whois information, Discover-Tech Ltd took ownership of both domains in 2020. While domain registration data became anonymized in 2022, mydsp[.]io redirected to discover-tech[.]io until early 2026. Both mtrtb[.]com and mydsp[.]io can be “attributed” to Discover-Tech Ltd according to Google, as discussed in Section 9.

MyDSP was launched by the Israeli adtech firm Matomy in 2016. In 2018, MyDSP was “connected” to Matomy’s MobFox subsidiary, had “access” to 50 billion daily ad impressions and was able to target 500 million users, according to its website. Also in 2018, Matomy sold MyDSP to the Cypriot firm Marketcom Technologies Ltd, which belongs to the e-commerce firm Market Group owned by the Israeli billionaire Teddy Sagi, as confirmed by public filings, business data, media reporting, and whois information for the domains mydsp[.]io and mtrtb[.]com. A 2019 version of the mydsp[.]io site confirms that MyDSP ultimately became part of Glispa, a Berlin-based adtech firm also acquired by Market Group back in 2015.

We are not aware of any robust information that shows how Discover-Tech Ltd eventually took over MyDSP, but whois information confirms that Discover-Tech Ltd, founded in March 2020, took control of the domains mydsp[.]io and mtrtb[.]com from Marketcom Technologies Ltd at some point between June and October 2020. According to a Google record, the ad provider with the ID ‘3036’ changed from MarketDSP (advertising.market[.]com) to “Discover-Tech Ltd” (discover-tech[.]io) on July 31, 2020. While the company names and websites changed, the list of additional domains attributable to this Google ad provider stayed identical: (mydsp[.]io and mtrtb[.]com).

JavaScript code related to MyDSP’s admin interface for customers, published on admin.mtrtb[.]com, details a list of ad vendors MyDSP was connected to at an unspecified point in time (archived code). The list includes Google, Yandex, Vungle, and Sunteng. Thus, it confirms the connections with the ad vendors we found in Discover-Tech’s bidding records (Section 5). In addition, the list suggests that MyDSP was or is also connected to the ad vendors MobFox, Inneractive, MoPub, PulsePoint, RhythmOne, GumGum, Pubmatic, Smaato, Sonobi, NativeAds, Unity, Q1Media, and Applovin.

Offerings for Mobile Carriers and Device Vendors

Discover-Tech Ltd itself can be traced back to a company named RelevanTech Ltd (relevantech[.]com), founded by Discover-Tech shareholders Dekel Boni and Yaniv Basil in 2015, according to their LinkedIn profiles and Israeli company records we reviewed. Like MyDSP, RelevanTech was also acquired by Market Group’s Glispa in 2017, and became Glispa Discover. Boni and Basil then worked for Glispa, before creating Discover-Tech Ltd in 2020.

The descriptions of the services provided by RelevanTech (2016), Glispa Discover (2017), and Discover-Tech Ltd are very similar. The current discover-tech.io site promises to help mobile network operators and mobile device manufacturers benefit from “sponsored and tailored app recommendations”, in addition to the company’s DSP offering. The 2022 version of the site explained that Discover-Tech would “place” mobile apps on new mobile devices “from the moment” they are “turned on” and provide “operator certified installs” of apps on new devices.

We are not aware of any robust information that shows how Discover-Tech’s founders regained control over what was left of RelevanTech from Glispa, but whois information confirms that Discover-Tech Ltd regained control of the domain relevantech[.]com in July 2020.

In 2021, Discover-Tech Ltd operated a mobile app on behalf of the Serbian subsidiary of the mobile network operator A1 Telekom Austria, according to a terms of use agreement, which explains that the app would provide A1 customers with content from both A1 and Discover-Tech. The description on the 2021 version of the Serbian A1 website suggests that the app, named “Moy A1” (“My A1”), enabled A1 customers to check their mobile plan, download invoices, and buy additional credits. Put differently, Discover-Tech was sitting inside the official app of the third-largest Serbian mobile operator. We do not know for how long Discover-Tech was involved in operating this app.

The 2020 version of the Discover-Tech lists A1 and device manufacturers like Samsung, Tecno, and Wiko among the company’s customers. We did not further investigate Discover-Tech’s mobile carrier and device manufacturer business, which may or may not be active anymore.

In conclusion, we believe that Discover-Tech emerged from both RelevanTech and MyDSP, both previously owned by Glispa. While MyDSP and additional software for the delivery of malicious ads appear to be operational in 2026, an asset sale discussed in the next subsection suggests that Discover-Tech may not offer its services for mobile carriers and device manufacturers anymore.

A Sale of Assets Leaves Open Questions 

In 2021, the Dubai-based firm Affle MEA FZ-LLC, part of the mobile advertising group Affle, based in Singapore and India, acquired “business assets” from Discover-Tech Ltd, according to public filings. Publicly available financial statements refer to the acquisition of a Discover-Tech “business segment” including “brand, IP, domain, business relationships and goodwill”.

Public filings further specify that Affle acquired Discover-Tech’s “mobile device marketing platform” that provides “initial device customization” including “dynamic app discovery and recommendation at initial boot or reset of a device” through its integrations with device manufacturers and mobile network operators. An Affle press release quotes Discover-Tech founder Dekel Boni stating that he was “proud” that Discover-Tech’s “technology” that “powers the first interaction a user has with his new device” would become part of the “app discover offering” of Appnext, another company acquired by Affle.

Based on the information available to us, we believe that Discover-Tech Ltd sold its offerings for mobile carriers and device vendors examined in the previous subsection, to Affle. We have no reason to believe that Affle has any control over Discover-Tech’s malicious ad operations that we investigate in this report. However, the exact scope of this asset sale remains unknown to us. Affle did not respond to our request for comment within the timeline provided.

Links to Intelos and Other Websites

In a parallel investigation, the ad security firm Confiant found that the websites discover-tech[.]io and tekma-dmp[.]ai were published from a single user account using the website publication system Wix, which embeds the customer “userid” in each site’s page metadata.

Additionally, we found that the website discover-tech[.]io has been sharing a single Wix user account with the website intelos[.]io for years. At some point after February 2026, the site intelos[.]io switched to a different “userid”. This switch strongly suggests that the websites discover-tech[.]io and intelos[.]io have been published by the same entity from at least September 2023 until February 2026.

As detailed in Section 8, the mercenary ADINT vendor Intelos, which reportedly offers both ad-based geolocation surveillance and the delivery of spyware via ads, has additional links to Discover-Tech via Intelos shareholder Eric Banoun (2018 – present), who was also a director of Discover-Tech (2020 – 2025).

As Table 8 shows, the Discover-Tech website shares the Wix user account with additional sites linked to Akedo (see the next subsections) and Tekma (see Section 8).

Adtimizer

We observed Discover-Tech using the domain dtech.adtimizer[.]co as impression and click URLs in ads. Israeli company records link the domain adtimizer[.]co to the Israeli firm Adtimizer Ltd, directed and owned by Oren Baranes. Baranes also appears in the HTML source code of the Controlium platform on the sites www.controlium[.]net and powerium[.]net:

<meta name="google-signin-client_id" content="oren.baranes@discover-tech.io.apps.googleusercontent.com">

<meta name="google-signin-client_id" content="[email protected]">

Furthermore, three users, “Oren Baranes”, “Oren baranes” (lowercase B), and “Oren Baranes Admin” regularly logged into Controlium in July 2026, according to authentication logs reviewed by us (see Section 3).

In 2022, Baranes posted on a public web forum⁴ using a Discover-Tech email address, in a forum thread that was discussing the advertising firm Beeswax:

Baranes’ LinkedIn profile does not mention Discover-Tech but presents him as an expert in mobile advertising.⁵ His appearance in the Controlium source code and his email address, which are both clearly linked to Discover-Tech, suggest that Oren Baranes is working for the company in some capacity. We consider the domain adtimizer[.]co and the Israeli company Adtimizer Ltd as linked to Discover-Tech. However, we do not have conclusive evidence that Adtimizer Ltd knowingly participated in the delivery of mercenary spyware attacks.

In its response to the Citizen Lab, Adtimizer Ltd claims that the subdomains we consider to be linked to Discover-Tech, including dtech.adtimizer[.]co, myinfoback.adtimizer[.]co, noas.adtimizer[.]co and tekma.adtimizer[.]co, were “used solely within Discover Tech’s infrastructure, which was entirely separate from ours and was not operated, managed, or controlled by Adtimizer”, and that Adtimizer “had no knowledge of, or involvement in the alleged activities” with respect to Discover-Tech’s malicious ad targeting.

MyIPInfo, Akedo, and Volasim

As discussed in Section 4, the sites adv45.volasim[.]com and adv50.volasim[.]com provided versions of Discover-Tech’s Controlium platform. The site myipinfo[.]io hosts a decryption tool linked to Controlium including keys used in conjunction with the Candiru attacks. The bidding logs reviewed in Section 5 show that the vast majority of ads served via Discover-Tech promote the MyIPInfo site, the mobile gaming platform Akedo, and an app provided by Volasim. 

The following subsections show that MyIPInfo, Akedo, and Volasim are linked to Discover-Tech and to each other in additional ways. The subsection ‘Response from Volasim Ltd’ below addresses in more detail Volasim’s response to The Citizen Lab where the company emphasizes that it has “no involvement whatsoever” in “spyware-related activities.”

Akedo

Akedo’s management team includes two Discover-Tech key executives and shareholders, Dekel Boni and Yaniv Basil, according to a promotional pdf published on the company’s website, akedo[.]gg. A person named Kfir Goldman is listed as the general manager of the Akedo platform. The document was created by a person, who is the “Chief Marketing Officer” at both Akedo (since 2022) and Discover-Tech (since 2019), according to their LinkedIn. Another person refers to themselves as the “Operations Manager” at both Akedo (since 2022) and Discover-Tech (since 2023). The fact that two persons work at both Akedo and Discover-Tech at the same time and in the same role, combined with the overlaps in the management team, indicates a relationship between the two companies.

The Akedo site does not refer to any legal entity. Israeli company records reviewed by us indicate that Eric Banoun, Dekel Boni, Yaniv Basil, and Kfir Goldman were shareholders in a firm named KYD Ltd, which in turn was a shareholder in a company named “Akedo Good Game Ltd”, which was directed by Boni. The two companies were dissolved in 2024 and 2025. As both the website and the Israeli company records refer to the same group of persons, we believe that the two legal entities were linked to Akedo’s activities until their dissolution.

Kfir Goldman, who is listed as part of Akedo’s management team and who was an indirect shareholder in Akedo Good Game Ltd, is included in a list of user accounts we found in the source code of Discover-Tech’s “Mini Platform C” app, as examined in Section 3. The listed accounts also include Dekel Boni, Yaniv Basil, and Guy Lants. This suggests that Kfir Goldman is or was also working for Discover-Tech in some capacity.

Volasim

The website volasim[.]com describes Volasim as a “digital marketing agency”, incorporated in Cyprus as Volasim Ltd, which serves advertisers using “ad platforms and real-time bidding platforms”. The address mentioned on the website and the registration address of Volasim Ltd, according to company records from Cyprus, are identical. The company is directed and owned by a person who is listed as a director of many companies registered in Cyprus, likely on behalf of other parties. We were not able to access information about Volasim’s ultimate beneficial owners.

Volasim Ltd is listed as a mobile app developer by both Google and Apple. It provides the game City Masters, the reminder app RemindMeWhere and two apps named MyIPInfo and Akedo. All four app listing pages refer to Volasim Ltd as the developer of the app, using the same address as mentioned in the corporate record and on the Volasim website. The app listing page for MyIPInfo refers to the website myipinfo[.]io, the page for the Akedo app refers to the site akedo[.]gg. The page for Volasim’s game lists the support email address kfir@volasim[.]com. We are not aware of any information confirming that this email address is associated with Kfir Goldman.

In addition to Discover-Tech’s Controlium platform being available on the sites adv45.volasim[.]com and adv50.volasim[.]com, the Controlium source code contains example data for the creation of a banner ad campaign for Volasim’s RemindMeWhere app, with the ad linking to the app’s website, remindmewhere[.]app. A Controlium-related “Banner Tester” app, as examined in Section 3, contains the description “Volasim test banner” in the source code. We also found a YouTube channel named “DT_VLSM” that uses Discover-Tech’s logo and lists a video that advertises Volasim’s reminder app.

MyIPInfo

The site myipinfo[.]io hosts Controlium-related code and is often being advertised by Discover-Tech. In addition, we found the same Google Tag Manager ID, which identifies a specific Google customer and their third-party tracking configuration across the sites myipinfo[.]io and events-ui.discover-tech[.]io, based on source code analysis. Passive DNS data indicates that the domain qabackend.myipinfo.io was linked to ipinfo.myweb3id.io. Several subdomains of myweb3id[.]io provide Controlium-related code and NOAS services, as discussed in other sections of this report.

The website myipinfo[.]io predominantly displays ads for Akedo, according to browser testing and the observation that the site loads a file named “ads.json” that contains Akedo ad data (urlscan). Based on source code analysis and data from the analysis tool DNSlytics, we found the same Google AdSense ID, which identifies a specific publisher selling ads via Google, across the sites events-ui.discover-tech[.]io, myipinfo[.]io, and akedo[.]gg. Another AdSense ID has been observed across the sites myipinfo[.]io, akedo[.]gg, and citymaster[.]io, which is the website for Volasim’s game app “City Masters”.

The website myipinfo[.]io does not contain any information about its publisher. Domain registration data is anonymized. However, as discussed above, the MyIPInfo mobile app is provided by the Cypriot firm Volasim Ltd, according to Google and Apple app store information.

Response from Volasim Ltd.

In its response to the Citizen Lab, Volasim Ltd refers to “Akedo” and “MyIPInfo” as “legitimate digital products developed by Volasim”. The company states that Discover-Tech was among the “external advertising providers” it engaged to “promote its products”. Volasim emphasizes in its response that it “has no involvement whatsoever in the spyware-related activities” discussed in our investigation, and that it has “never commissioned, authorized, participated in, or knowingly facilitated any such activity”.

As summarized in this subsection (‘MyIPInfo, Akedo, and Volasim’), we found that Volasim and its products Akedo and MyIPInfo are linked to Discover-Tech in several ways. However, at this time, we do not have conclusive evidence that Volasim Ltd knowingly participated in the delivery of mercenary spyware attacks.

8. Intelos, Bindecy, and Candiru’s Corporate Networks

This section provides an overview of Intelos, Bindecy, and Candiru, and provides details on what we know about their corporate networks and business identities. Furthermore, we present additional links between Discover-Tech and Intelos.

Intelos and Its ADINT System AdHoc

In 2023, the trade press website Intelligence Online and Haaretz first reported about Intelos, a new Israeli ADINT vendor that provides a surveillance system based on data from digital advertising named “AdHoc”. Intelos was reportedly founded by Eric Banoun, who is “one of the pioneers of offensive cyber in Israel” according to Haaretz. Israeli company records reviewed by us confirm that Banoun has been a shareholder in Intelos Ltd from its registration in 2018 until present, and he is listed as the company’s director. The email address he uses in corporate filings, [email protected], clearly links Intelos Ltd to the website intelos.io.

The fact that Banoun was also listed as a director of Discover-Tech Ltd (see Section 7), already suggests a potential connection between the ADINT vendor Intelos and Discover-Tech. In addition, the websites intelos[.]io and discover-tech[.]io were published by the same entity until at least February 2026, according to technical analysis discussed in Section 7. While we cannot assess the exact scope of the collaboration between Intelos and Discover-Tech, the technical analysis discussed in Section 4 indicates that the two work together.

Besides a few media articles and the company’s website, there is almost no public information available about Intelos. The company’s AdHoc product is not mentioned on its website. According to Israeli company records reviewed by us, Intelos Ltd’s shareholders include Eric Banoun, Senpai co-founder Roy Shloman, Thai businessman Charoenrath Vilailuck, and a Liechtenstein-based firm named SAR Investments International Ltd, among others.

On its website, Intelos purports to be a “marketing intelligence” platform that monitors “worldwide digital signals, actions, and preferences”, including “subtle changes in behaviour”, by processing 16 billion “daily data sets” across 50 countries. Much of the promotional language on the site sounds like the company’s products are built for customers in digital marketing, but could also describe an ADINT vendor. Intelos promises to “map behavioural patterns across audiences” and to build “profiles of audiences and groups” in order to “map relationships, track behavioural shifts, and anticipate collective action”. It also provides “location intelligence” based on a “proprietary index of the physical world” with “every relevant location classified, mapped, and weighted for significance”. Another system named “Nexus AI” could transform “raw data into structured insights” based on “live and historical datasets” in order to “map behavioural clusters” and “detect relationships”.

Haaretz and Intelligence Online reported that Intelos provides ad-based geolocation surveillance but also the delivery of spyware via ads, without providing details about the latter. Its technology was reportedly offered to the Shin Bet in Israel and sold in Thailand. According to Haaretz, Eric Banoun presented an ADINT product named “Havoc” that included the AdHoc logo to an Egyptian customer. An agreement related to his presentation mentioned a U.K. firm, whose director is also the director of another U.K. firm named “Havoc”, which sold an unnamed cyber system to an unnamed country over a period of three years at a cost of about $42 million. Based on the media report, it remains unclear whether AdHoc was sold in Egypt or not.

Intelos did not respond to our request for comment within the timeline provided.

Tekma

The 2025 version of the site intelos[.]io shares many promotional phrases with the 2024 version of the website tekma-dmp[.]ai. Both sites offered a “Data Marketing (DM) platform” and the “AI Edge” product using a number of identical sentences. According to the current website, Tekma purports to have access to data on 3.5 billion devices, which can be utilized “across major DSPs”, and is based in Dubai, with regional offices in Greece, Cyprus, and Spain. The 2024 site includes Tekma contact information referring to “Chaia Services” and mentions another regional office in Hong Kong. Another older but also almost identical site, tekma[.]io, includes Tekma contact information referring to “Chaia Ltd” in “13&15 GR. Afxentiou Street, Mesa Geitonia Limassol, Limassol 4003 CY”.

Technical analysis discussed in Section 7 shows that the websites intelos[.]io, tekma-dmp[.]ai, discover-tech[.]io, and www.partners.akedo[.]gg were published by a single entity between 2024 and 2026. The site tekma[.]io was also published by the same entity.

As discussed in Section 7, Discover-Tech Ltd’s shareholders include a company named Chaia Services Ltd. Notably, the Israeli firm Adtimizer Ltd (see Section 7) has the subdomain tekma.adtimizer[.]co. Between 2020 and 2025, this subdomain was linked to the following host name via CNAME, according to DNS telemetry:

discovertech-alb-100966113.us-east-1.elb.amazonaws.com

discovertech-alb-100966113.us-east-1.elb.amazonaws.com

Discover-Tech Mercenary Spyware Partner: Bindecy

Bindecy is “one [of] Israel’s lesser known spyware firms”, though it “develops and sells digital surveillance tools to states” with a focus on “Western clients and their close allies in the east”, according to Haaretz. On its website, bindecy.com, it presents itself as a cybersecurity firm founded by Israeli military intelligence alumni that analyzes apps and “critical systems”. The trade press website Intelligence Online reported that Bindecy, founded by Daniel Shapiro and Eylon Ben Yaakov, has “cyber offensive contracts from the Israeli intelligence services” and sold its “zero-click spyware” to Italy’s military police, the Carabinieri.

In 2021, Bindecy acquired part of the intellectual property of Merlinx, another Israeli cyber offensive company formerly known as Equus Technologies. In 2024, Haaretz reported that the founders of Bindecy recently joined the Spanish company Epsilon, which develops exploits and is “aiming for the American market”, as partners. According to its website, epsilon-sec.com, the company offers security research on mobile platforms and is located in Spain, France, and Canada.

Company records reviewed by us indicate that the Israeli company Bindecy Ltd was founded in 2017. Since 2025, it has a solely owned subsidiary named Shor Labs s.r.o. registered in the Czech Republic. Bindecy co-founder Daniel Shapiro is listed as a director of both Shor Labs s.r.o and Spanish Epsilon Cyber SL.

Bindecy did not respond to our request for comment within the timeline provided.

Discover-Tech Mercenary Spyware Partner: Candiru/Integrity Labs

Candiru is an Israeli-founded mercenary spyware company that draws its original name from the parasitic Candiru fish, and has operated under a wide range of names throughout the years, including Saito Tech. Today, Candiru operates under the rebranded identity of Integrity Labs after acquisition by U.S.-based Integrity Partners. 

Candiru: Prior Investigations, Abuses, and Discoveries

Candiru is a mercenary spyware threat actor known by multiple names, including SOURGUM and Carmel Tsunami by Microsoft.

First Candiru Abuse Discoveries: 2021

On July 15, 2021, the Citizen Lab published the first report exposing Candiru. That investigation included identifying a Candiru victim and recovering a copy of Candiru’s Windows spyware. We then worked with Microsoft’s Threat Intelligence Center (MSTIC) to analyze the spyware, which led to the identification of two zero-day vulnerabilities (CVE-2021-31979 and CVE-2021-33771). We also identified over 750 websites linked to Candiru’s infection infrastructure that masqueraded as a wide range of civil society entities ranging from media organizations to Amnesty International.

On July 14, 2021, Google TAG published a report which included discussion of two Chrome exploits (CVE-2021-21166 and CVE-2021-30551) that pointed to addresses matching our Candiru fingerprint. The report also linked a Microsoft Office exploit (CVE-2021-33742) to the same operator.

Microsoft’s own investigation into Candiru, published simultaneously with our report on July 15, 2021, identified at least 100 spyware victims across ten countries. Microsoft reported that the victims included journalists, opposition politicians, dissidents, and activists. 

On November 16, 2021, ESET reported on a series of watering hole attacks observed in 2020 and 2021 targeting websites in the Middle East with what they described as a “strong focus on Yemen.” They attributed the attacks to Candiru.

Further Investigations and Abuses: 2022-2025

In 2022, the Citizen Lab again found Candiru spyware targeting victims among Catalan civil society groups in Spain. In that investigation, we identified signs of a live Candiru infection on a Catalan university network, and successfully worked with system administrators to identify the victim, isolate the device, and extract the active spyware. The targeting we observed as part of this campaign included emails masquerading as official Spanish governmental messages about COVID.

On July 21, 2022, Avast published a report revealing that Candiru was using a Chrome zero-day exploiting WebRTC (CVE-2022-2294), and found evidence of targeting of users in multiple countries in the Middle East.

On December 22, 2022, Meta disclosed that it disrupted around 130 Facebook and Instagram accounts used by Candiru to send infection links amongst themselves to “test phishing capabilities.”

In the summer of 2024, during the parliamentary election campaign, Member of the European Parliament (MEP) Daniel Freund was targeted with Candiru’s mercenary spyware, according to the European Parliament’s security services. 

On August 5, 2025, Recorded Future’s Insikt Group investigated Candiru infrastructure and identified multiple Candiru clusters linked to Hungary, Saudi Arabia, Indonesia, and Azerbaijan, among others. 

On September 2, 2025, Sekoia published an investigation into Candiru’s spyware, highlighting how Candiru and similar companies leverage complex jurisdictional structures to avoid discovery.

Entity Listing

On November 3, 2021, Candiru was added to the United States Commerce Department’s Entity List for malicious cyber activities. The entity listing noted that Candiru was added because “they developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.” 

Legal Actions Against Candiru and Users

In October 2024, Daniel Freund filed a criminal complaint with the assistance of German digital rights NGO GFF against Viktor Orbán and unnamed persons over his targeting with Candiru.

On April 30, 2025, the NGO Sentinel Alliance filed a case against multiple Spanish governmental entities, NSO Group, and Candiru over the mercenary spyware attacks targeting Catalan civil society.

Candiru’s 2025 Acquisition by Integrity Partners 

In April 2025, Israeli media reported that U.S.-based Integrity Partners acquired the operations of Candiru for $30 million in a bid to bypass the U.S. Entity Listing. Research by Recorded Future’s Insikt Group identified Candiru as having been rebranded to “Integrity Labs”  (אינטגריטי לאבס בע~מ) in December 2024. The current status of the acquisition is unclear.

Candiru/Integrity Labs did not respond to our request for comment within the timeline provided.

9. Discover-Tech’s Relationship to the Digital Advertising Industry

This section explores how major industry organizations and ad vendors helped enable Discover-Tech’s ad operations, and notes that Discover-Tech achieved “certified” and “approved” status by Google and the major advertising industry association IAB Europe.

Our analysis indicates that Discover-Tech deployed ads via Google, Yandex, and other ad vendors including Beeswax (FreeWheel/Comcast), Vungle (Liftoff), Eskimi, and Sunteng. In addition, both Google and the advertising association IAB Europe have listed Discover-Tech as a “certified” and “approved” ad vendor since the year 2020, which helped make the company appear to be a legitimate advertising firm and facilitate its participation in the advertising ecosystem at scale.

As a result of this investigation, both Google and IAB Europe removed Discover-Tech from their ad vendor registries in early October 2026. Google, which collaborated in the investigation, terminated Discover-Tech’s access to its ad exchange platforms. Beeswax removed Discover-Tech from its ad buying platform. Vungle (Liftoff) paused Discover-Tech’s access while conducting a review. Eskimi blocked Discover-Tech’s accounts and domains.

The ad vendors identified in this section are distinct from mercenary spyware or ADINT vendors insofar as they are not necessarily aware of potential misuses of their infrastructure for non-advertising purposes.

Discover-Tech: Got “Certified” and “Approved” by Google and IAB Europe

Table 9 provides an overview of ad vendor lists maintained by Google and IAB Europe, the European branch of the major advertising industry association IAB, which included Discover-Tech from the year 2020 until early October 2026:

Google listed Discover-Tech Ltd among its roughly 2,400 Certified External Vendors. These vendors, which Google also refers to as “allowed vendors” and “certified companies”, “undergo a business review,” the nature of which is not specified, so they “can serve third-party ads on the Google Ad Manager platform”. Google claims to “conduct a thorough certification process” for “vendors that are certified for third-party ads” and ensure they “meet Google’s requirements for third-party ad serving”. A listed vendor is “permitted to make third-party calls”, which may include tracking pixels. Google emphasizes that it might pause the delivery of ads when it detects “non certified vendors”. Being listed is crucial for a company that wants to interface with Google.

Google also listed Discover-Tech among its roughly 1,000 Ad Technology Providers, who can receive data on website visitors and app users in Europe. In Google’s own words, these vendors “agreed to comply” with its “data usage policy” and “have shared certain information that is required by European regulations policy”. Website and app publishers “need to list these partners for [their] users.” Until 2025, Google referred to these vendors as “certified ad technology providers,” but a later redesign of the page dropped the term “certified.” In addition, Google listed Discover-Tech in its global list of roughly 1,700 ads personalization providers, which may participate in ad auctions based on “user consent”. The list contains “domains which can be attributed to the provider.” For Discover-Tech Ltd, the domains mtrtb[.]com and mydsp[.]io are listed.

Discover-Tech Ltd was added to all these lists in 2020. Google, which collaborated in this investigation, removed Discover-Tech from its ad vendor registries and terminated the company’s access to its ad exchange platforms as of the first week of October, 2026.

Discover-Tech Ltd was also listed in the Global Vendor List (GVL) maintained by the European branch of the Interactive Advertising Bureau (IAB), a key digital advertising industry association. The GVL contains roughly 1,000 vendors that are “registered and approved” by IAB Europe. These vendors can participate in IAB Europe’s “Transparency & Consent Framework” (TCF), which promises to enable ad vendors to comply with European data protection and privacy law when processing personal data for digital advertising purposes. While the TCF’s ability to enable lawful data processing is controversially debated, a GVL registration has become a de-facto requirement for an ad vendor to participate in digital advertising, display ads and receive data in Europe. IAB Europe added Discover-Tech Ltd to the GVL on July 2, 2020. As a result of this investigation, Discover-Tech was removed from the GVL on October 8, 2026.

According to IAB Europe, it takes “reasonable steps to vet and approve” vendor applications, including the “identity of the party or parties controlling the vendor” and the vendor’s ability to “adhere” to a number of TCF policies, and then monitors their compliance with those policies. The TCF is the basis for passing user “consent” signals for personal data processing across the digital advertising supply chain, from users to publishers to intermediaries (like SSPs, DSPs, and ad exchanges) to advertisers, including in bid requests and tracking pixels. Most ad tags and tracking pixels that connect to third-party vendors require “consent” signals, including in some jurisdictions outside Europe and the U.K. like California. Google, Xandr, and most larger ad platforms require TCF compliance. While several studies found that vendors are too often ignoring “consent” signals, an ad vendor that is not listed in the GVL, and thus cannot pass any signal, can hardly interface with other ad vendors in reliable ways.

While the vendor lists maintained by Google and the IAB Europe help a company appear to be a legitimate ad vendor and are the basis to participate in the digital advertising ecosystem in a reliable way at scale, they appear to be largely based on self-attestation by vendors. They are also the basis for most of the “consent” popups shown to European web and app users every day. Discover-Tech Ltd’s inclusion in those lists potentially means that, for almost six years, hundreds of millions of Europeans were presented with a consent request that, if the recipient clicked “Agree,” could be construed as authorizing Discover-Tech to process their data under the GDPR.

As of October 2026, Discover-Tech is additionally listed in a registry operated by the “Trustworthy Accountability Group” (TAG) created by major U.S. advertising associations and the IAB, which aims to increase trust in the digital advertising industry, eliminate fraud and fight criminal activity including “malware threats targeting the digital advertising supply chain”. The Verified by TAG badge held by Discover-Tech, which the company also displays on its website, is used across the industry to “determine trust and transparency” and let prospective partners know that a company has taken “actionable steps to verify their identities and adopt rigorous standards to fight online fraud, piracy, malware, and lack of transparency”, according to the TAG website.

Advertising Firms Involved in Discover-Tech’s Targeting

Our analysis of ad bidding data in Section 5 indicates that Discover-Tech targeted users by participating in ad auctions handled by Google, Yandex, and other ad vendors including Vungle and Sunteng. The analysis of the Controlium platform in Sections 3 and 6 indicates that Discover-Tech also uses the ad buying platforms Beeswax DSP and Eskimi DSP to target users. In addition, those sections show that Discover-Tech receives and utilizes user identifiers maintained by Microsoft’s advertising platform Xandr.

Table 10 provides a summary of ad vendors involved in Discover-Tech’s ad operations, according to the research presented in this report. The table briefly summarizes our findings with respect to their involvement. The descriptions of vendors and their offerings are based on additional research that is included in the Appendix of this report.

Google, which collaborated in the investigation, terminated Discover-Tech’s access to its ad exchange platforms in early October 2026. As detailed in their responses to the Citizen Lab, Beeswax removed Discover-Tech from its ad buying platform, Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains. Sunteng and Xandr (Microsoft Advertising) did not respond to our requests for comment within the timeline provided.

10. Discussion: AdFection Shows that Online Ads Are a Cybersecurity and Privacy Crisis

This report provides the first-ever technical evidence of zero-click mercenary spyware attacks delivered via targeted advertising. We also confirm that AdFection was used to infect devices at international media organization Al Jazeera.

These attacks were facilitated by Discover-Tech, which presents itself as a legitimate advertising business but actually serves as a bridge between mercenary spyware companies and the advertising ecosystem. Discover-Tech not only helps companies like Candiru use ads to mass-profile unwitting phone users, their ads directly enable these companies to silently infect selected targets’ devices.

The combination of advertising intelligence and the delivery of spyware is extremely concerning, for several reasons. First, both the digital advertising and mercenary spyware industry are very poorly regulated, with the latter featuring numerous firms notorious for deception, a lack of transparency, and even unlawful activities. To see entities from those two industries forming an alliance should be a wakeup call to regulators and policymakers around the world. Dozens of reports by numerous organizations, including the Citizen Lab, have shown incontrovertible proof of the harms caused by mercenary spyware vendors on civil society around the globe. With the addition of the type of advertising intelligence capabilities we have documented, those firms’ capabilities will now be supercharged.

Second, the combination of advertising intelligence and spyware infections provide government security agencies with highly invasive systems that span both mass and highly targeted types of user surveillance. As we show in this report, millions of devices were likely unwittingly profiled as a form of preliminary reconnaissance to enable targeting with spyware tailored to those device’s specific characteristics. Ominously, many of these infections took place without any visible indication of tampering or other clues that might have alerted them to the compromise. Also ominous is the fact that the services of Discover-Tech appear to span multiple regions around the globe. It is not known at this time exactly which governments are capitalizing on these new capabilities, but if past evidence is any indication it seems highly likely that some proportion of them are abusing those capabilities to target individuals outside of strictly criminal or national security purposes.

ADINT: Journalism in the Crosshairs

The hacking of Al Jazeera with AdFection is part of a longstanding pattern: mercenary spyware attacks against the media. Journalists and newsrooms are a constant target for spyware attacks, and this latest case highlights how well-resourced operators consistently seek new ways to access their private, protected communications.  

The use of spyware to target the media directly interferes with the ability of the free press to hold power to account. It also threatens the privacy of journalists’ sources, and can chill reporting. Foreknowledge of movements, reporting topics, meetings, and sources does not just help powerful interests try to frustrate coverage and reporting, it can put people at physical risk. This is especially true for a news organization with reporters, freelancers, stringers, fixers and sources working in conflict zones around the world.  

Investigations into mercenary spyware operations have repeatedly surfaced targeting against the media, including in the context of governmental and cartel killings of reporters. Journalists have been confirmed spyware targets, from the Citizen Lab’s earliest findings of Pegasus spyware in Mexico almost a decade ago, to cases across Africa from Angola to Morocco and Togo, to Jordan, Serbia, El Salvador, and Italy, among many others. Organizations like Reporters Without Borders provide helpful overviews of the scale of the threat which, as Access Now points out, is sometimes coupled with laws designed to authorize government access to journalists’ communications. The International Federation of Journalists, meanwhile, has a recent overview of how spyware is situated within a broader set of digital threats against journalists. 

Recently, reporting from the Committee to Protect Journalists outlined the dangers posed to journalists from ADINT-style tracking. The combination of this tracking with zero-click mercenary spyware targeting presents an even more serious danger to journalists’ safety.

This investigation should also serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat. This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members. We urge news organizations to immediately seek expert assistance and ensure that their systems are protected against these attacks to the fullest extent possible. We provide some guidance in Section 11, however we urge all news organizations to systematically review their security posture (and logs) for signs of AdFection style spyware targeting and infection.

The Advertising Industry: A Dangerous Lack of Due Diligence 

Our findings also reveal a troubling lack of due diligence within the digital advertising industry that helped enable this inappropriate activity. Discover-Tech, which presented itself as a legitimate ad vendor but served as a bridge between the online advertising ecosystem and the spyware industry, has been deeply embedded and interconnected with the online advertising ecosystem for years. Multiple ad vendors let the company utilize their systems. The two key industry organizations, Google and IAB Europe, have helped Discover-Tech appear as a legitimate ad vendor from the year 2020 until 2026, despite information about the company’s links to figures in the spyware industry being readily accessible in corporate records. Our findings show that the digital advertising industry is ill-prepared to prevent malicious actors from exploiting its infrastructure for the distribution of spyware via targeted ads.

Advertising Industry: Prioritize Security, Stop AdFection

This case should serve as an alarm to the advertising industry that business as usual is no longer acceptable. The online advertising industry must get serious about tackling the distribution of mercenary spyware via targeted ads, alongside other malicious advertising practices including financially motivated fraud and cybercrime. Technical and organizational measures currently implemented by the industry, such as the SafeFrame specification or standards for supply chain transparency are insufficient or not even adopted in a meaningful way.

Fix a Broken Digital Infrastructure

More broadly, the distribution of spyware via targeted ads depends on the way digital advertising – and the web economy at large – currently operate.

Many mobile apps and websites contain tracking software operated by dozens of third parties, which themselves may include code by additional third parties within apps and browsers. Also required for the targeted deployment of spyware, ad targeting at the individual level depends on uncontrolled data sharing via RTB auctions and third-party tracking.

Automated ad selling and buying via RTB, which connects large numbers of publishers, advertisers and intermediaries across opaque supply chains, is designed to minimize human intervention. When combined with a lack of oversight and accountability, it is generally prone to abuse. This is further aggravated by the assumption that at least some ad vendors benefit from malicious and fraudulent advertising. Leaked internal documents from Meta reported by Reuters suggest that Meta estimated that it earns between five and ten percent of its annual revenue from running fraudulent ads. Industry sources suggest that ad fraud accounts for one fifth of all online advertising spend. 

This broken digital infrastructure needs to be reformed at several levels, as consumer associations, regulators, and policymakers have long been demanding.

AdFection: A Threat to States, Civil Society, and Everyone Else

The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large. Two major U.S. security agencies, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have warned already in 2018 and 2020 that adversaries may leverage malicious ads to deploy malware on devices, and thus both recommended that government agencies and other organizations use ad-blocking software.

Given the current threat posed by Discover-Tech’s AdFection vectors, and the evidence of wide-scale targeting, we judge that the most feasible protection is for defenders to block targeted ads at the gateway. This defensive recommendation (see Section 11) holds until the industry has shown that it is reliably able to block all AdFection style vectors.

At the very time that state actors may be employing offensive cyber attacks, malicious ads can be deployed via apps and websites used by defense personnel, political leaders, and people maintaining critical infrastructure alike, creating national security risks for those very same states. The same structural deficits that endanger civil society, journalists, and opposition figures are potentially exploited by both foreign adversaries and cybercriminals, creating systemic risks for everyone. These security risks make it apparent that there is an urgent public-interest need to reform digital advertising.

The same risks apply to the private sector and to civil society. Indeed, as prior research has made clear, a large number of governments will use these potent capabilities to undermine political opposition, stealthily target journalists and lawyers, and target refugees, immigrants, and other vulnerable populations. The mercenary spyware industry is already notorious for widespread harms; fueling that industry with digital advertising capabilities will multiply those harms immeasurably.

11. Recommendations: How to Stop AdFection Attacks

The AdFection attacks and espionage described in this report impact millions of people in dozens of countries. Existing laws and self-regulation by the industry failed to catch or prevent them. In this section, we provide guidance to regulators, defenders, and the advertising industry on how to stop AdFection and ADINT-style espionage.

Advertising Vendors: Time to Get Serious

The advertising industry uses terms like “certified” and “approved” to try and convey a veneer of effective self regulation. However, the industry appears to perform no meaningful due diligence on participating vendors, instead improperly relying on self-attestation where vendors check a box on an online form. This process allows widespread privacy abuses, including failing to prevent mass espionage via targeted ads.

Ad vendors must significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain. They must rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains. This type of more robust due diligence applies in particular to key industry organizations and dominant players who must introduce rigorous and regular audits for companies listed in ad vendor registries which they maintain and provide to many other actors in the supply chain. Business partners from countries with opaque corporate registries or where known malicious actors operate deserve specific attention.

Technical and organizational measures to be taken must include both vendor-specific and industry-wide efforts. Cybersecurity agencies and other regulators in the U.S., Canada, Europe, and other regions must support these efforts by investigating risks, calling out shortcomings and taking action to ensure the implementation of effective measures by the advertising industry.

• Detect and block malicious ads: Ad vendors must radically increase their capacity to identify AdFection-style attacks in real-time, alongside other forms of malicious advertising such as ad fraud, across their supply chain. 
• Share threat data: Develop better threat sharing and clearinghouses for sharing information about malicious actors and recklessly permissive jurisdictions.
• Vet and screen partners: Implement mandatory know-your-customer, including due diligence and recurring vetting for all partners and other firms who transact over the provided ad and data services. 
• Audit vendor registries: Major advertising organizations must introduce mandatory third-party audits for “certified” or “approved” vendors. 
• Ban vendors in problem jurisdictions: Adopt a default-deny policy for vendors operating in jurisdictions known to be highly permissive of abuse, or without accountability mechanisms.
• Fix systemic vulnerabilities: Implement industry-wide measures to improve ad delivery security and to introduce full supply chain transparency, and support their adoption.

Zero-Click AdFection

We urge regulators to take immediate action to ensure that advertising platforms and partners stop facilitating AdFection-style attacks, and secure their populations from the security, cybersecurity, and privacy threats posed by the advertising ecosystem.

Investigation and Enforcement

• Immediately investigate Discover-Tech and Candiru: Our research showed large-scale data collection from millions of devices involving Discover-Tech and Candiru. The data was apparently collected for the purposes of AdFection. We urge competent authorities in all jurisdictions to investigate whether the rights of their citizens, as well as applicable privacy and security laws were violated.
• Enforce existing laws: It is unlikely that Discover-Tech is the only enabler of AdFection-style zero-click attacks. Authorities should more closely scrutinize the advertising ecosystem to determine whether other companies are leveraging it for espionage and spyware delivery, and determine whether they have violated applicable laws and regulations.
• Enforcement and sanctions: Use all necessary domestic enforcement and sanctions authorities to discourage AdFection abuse. These measures can include the use of sanctions and entity-listing powers against firms that deploy mercenary spyware and conduct espionage via targeted ads, the companies that enable them, and the individuals who work in the AdFection domain.

Legal and Regulatory Improvements

• Commission investigations: Enlist the assistance of cybersecurity agencies and regulatory bodies to evaluate the security, privacy, and national security risks from the current advertising ecosystem.
• Tighten privacy regulations around ad tracking and targeting data: Evaluate legislation to remove personal data from RTB auctions and work with international partners to adopt similar measures. 
• Real regulation of the advertising industry: It is time for regulators and lawmakers to develop frameworks based on mandatory oversight with clear enforcement mechanisms and penalties for violation. 
• Independent audits and KYC: Require that the advertising industry implement third-party audits and know-your-customer standards for all their business partners, as well as companies included in “certified” vendor registries. Develop meaningful penalties for failure to comply or misrepresentation.

Securing National Infrastructure Requires Blocking Ads and Tracking on Official Devices

• Mandatory ad-blocking on government devices: Issue policy guidance aligned with relevant cybersecurity agencies (e.g., CISA and NSA in the U.S.) recommendations requiring ad-blocking software on edge devices, and ad-blocking at the gateway for all government-owned devices. (See, for example, U.S. Senator Ron Wyden’s letter to the CIO of the U.S. Department of Defense, as well as Senator Wyden and Rep. Harrigon’s joint letter to the Inspector General of the U.S. Department of Defense).
• Opt-out of ad targeting: Mandate the disabling of unique advertising IDs on all government mobile devices (such as through MDM), and issue guidance and policy recommendations for personal devices used in governmental spaces.
• Ban browsers that facilitate data harvesting: Evaluate the security risks of browsers with impossible-to-disable tracking, and consider provisionally banning them from governmental networks and devices.

Defenders: Ad-Blocking Is A Cybersecurity Best Practice

AdFection attacks demonstrate that online advertising is now a vector for zero-click spyware infection into your organization. Taken together with research showing that data from targeted advertising is already being used for mass espionage, and potentially for corporate espionage, this makes it clear there is currently no consistently safe way to expose your users and networks to targeted ads. You can directly block Discover-Tech’s current methods by blocking advertising identifiers, however we suspect that the AdFection attack surface may be larger, requiring more systematic measures. 

• Block ads and tracking on devices and at the gateway: Where possible, block online advertising at the gateway to your organization, and on work-issued and edge devices. Opting out of ad targeting (such as through MDM) on company-issued devices is also advisable. We also encourage you to develop guidance and easily actionable tools to help your personnel protect their devices.
• Transition towards browsers with less tracking: Browsers with built-in anti-tracking features, ad-blocking, and support for the Global Privacy Control (GPC) will improve your security posture and protect your IP.
• Scrutinize targeted ads: We encourage defenders to monitor traffic linked to advertising impressions for signs of malicious requests.

Protecting Yourself from AdFection

AdFection is a complex threat, and if you face elevated risk because of who you are or what you do, we strongly recommend seeking expert help. However, there are certain actions you can take to reduce some AdFection risks.

• Increase your overall security by following personalized instructions from the Security Planner.
• Use a trusted ad-blocking extension on your browser to reduce tracking.
• Consider using a privacy-respecting browser that blocks tracking and data-harvesting.
• Regularly reset your Mobile Advertising ID, disable ad-tracking, and use opt-out features of apps.
• Consider using an ad-blocking service on your network, such as at your home router, or use a trusted commercial VPN service that offers ad-blocking.

Further Research

Our investigation found that an attacker that we call DARK CARTOGRAPHER used Discover-Tech ads and a number of additional vendors to deanonymize users at scale since at least 2019. As these efforts rely on the exploitation of widespread security issues across numerous mobile providers, disclosure to providers is in progress. We will release a subsequent report delving into technical analysis and attribution of these attacks once the disclosure process is complete.

Based on our findings, we believe that further research would be fruitful with respect to:

• customers and victims of the ad-based spyware deployment capabilities provided by Discover-Tech and the companies linked to it, including Candiru, Bindecy, and Intelos;
• additional vendors and vendor networks that deploy ad-based spyware; and,
• technical, organizational, regulatory, and political measures that effectively prevent the distribution of spyware via digital advertising.

This report is part of an ongoing series of investigations we are doing on surveillance technologies that rely on digital advertising. We will be publishing subsequent investigations that explore areas for further research we have flagged in this report.

Correspondence with Companies

We sent requests for comment to Discover-Tech Ltd, Candiru (Integity Labs), Bindecy, Intelos, Adtimizer Ltd., Volasim Ltd., Beeswax (FreeWheel), Eskimi, Xandr (Microsoft Advertising), Vungle (Liftoff), Sunteng, IAB Europe, and Affle. We gave each company a chance to respond before a specific deadline, and committed to publishing any response received before that deadline.

Discover-Tech Ltd, Candiru (Integrity Labs), Bindecy, Intelos, Xandr (Microsoft Advertising), Sunteng, IAB Europe, and Affle did not respond to our request for comment within the timeline provided.

On October 11, 2026, we received a response from Adtimizer Ltd. In its response, Adtimizer Ltd claims that the adtimizer.[co] subdomains we consider to be linked to Discover-Tech were “used solely within Discover Tech’s infrastructure, which was entirely separate from ours and was not operated, managed, or controlled by Adtimizer”, and that Adtimizer “had no knowledge of, or involvement in the alleged activities” with respect to Discover-Tech’s malicious ad targeting. The company’s full response is available here.

On October 12, 2026 we received a response from Volasim Ltd. In its response, Volasim states that Discover-Tech was among the “external advertising providers” it engaged to “promote its products”. Volasim emphasizes in its response that it “has no involvement whatsoever in the spyware-related activities” discussed in our investigation, and that it has “never commissioned, authorized, participated in, or knowingly facilitated any such activity”.  The company’s full response is available here.

On October 12, 2026, we received a response from Vungle (Liftoff), stating: “We have paused all Discover-Tech Ltd. access while we conduct our own review. Because this review is ongoing, we are not currently in a position to confirm or comment on the specific factual assertions in your letter. We will take any further action warranted.”

On October 13, 2026, we received a response from Beeswax (FreeWheel / Comcast), stating as follows: “Beeswax constantly monitors traffic quality and security threats to its Buyer Cloud platform through internal controls and third-party detection tools. Based on activity we observed recently, and after independent third-party security specialist validation, Beeswax already acted to remove Discover-Tech from Buyer Cloud. Malicious advertising of any kind is prohibited on our platform, and we will keep working with our security partners and the wider industry to detect and remove bad actors.”

On October 14, 2026, we received a response from Eskimi, stating: “Eskimi has clear rules and controls designed to detect and stop advertisers who try to misuse our platform. Campaigns and creative tags are screened by independent third-party ad-verification vendors as well as by our own monitoring tools. In this case, the advertiser’s tags were built to evade automated scanning. They loaded different code depending on who was viewing the ad, including the device, IP address and location, and campaigns were often restricted to very narrow IP target lists. This is how they passed third-party verification. Our own monitoring flagged this behaviour, and campaigns and individual tags were stopped as our controls detected them. We have since shared the relevant technical indicators with our supply partners. In the interest of supporting your research, the indicators we identified include creative tags calling remote “getAd” loaders hosted on dtech.adtimizer.co, several mtrtb.com subdomains (noas, infinoas and ppv2), and events.myweb3id.io. Because these loaders served different code depending on the viewer and targeting, they were not detected by third-party ad-verification scanning. Additional technical information can be provided where it is useful for your research. Discover-Tech had been a self-service advertiser on the Eskimi DSP since 2022, under our standard advertiser terms. Because of our campaign and individual tag blocks, its activity remained small, amounting to only a few hundred dollars in media spend. Its last campaign through the Eskimi DSP was stopped on 6 August 2026, and no impressions have been served since. Once the full pattern of the advertiser’s behaviour became clear, we permanently blocked all of its accounts, users and associated domains. We are working with independent ad-security specialists to help identify similar behaviour across the industry. As I mentioned, happy to contribute with anything that can help with further investigation and ensuring compliance in the ad-tech market.”

Google, which collaborated in the investigation, informed us that it “terminated Discover-Tech’s access to its ad exchange platforms, blocking them from bidding or serving ads across our ecosystem. Google has also deployed Safe Browsing protections to warn users that may encounter known actor-controlled domains”.

Note on Research Ethics

All research involving human subjects conducted at the Citizen Lab is governed under research ethics protocols reviewed and approved by the University of Toronto’s Research Ethics Board.

Acknowledgements

We thank the teams at Al Jazeera for graciously consenting to our investigating this case, and agreeing to be named in the report.

We thank the teams at Confiant, Google, and additional researchers for their assistance and collaboration in this investigation. We would also like to thank Rebekah Brown, Maia Scott, and Krzysztof Franaszek (Adalytics Research) for peer reviewing this work, as well as other anonymous peer reviewers. Thanks to Adam Senft, Aly Bruce, Anna Mackay, and Claire Posno for editorial and communications support. 

Appendix A. Ad Vendors Involved in Discover-Tech’s Ad Operations

Google and Yandex

Google dominates the digital advertising ecosystem in the U.S., Europe, and other regions. It operates a massive ad exchange and systems for ad sellers (Ad Manager, AdSense, AdMob) and ad buyers (Google Ads, DV360). Its “Authorized Buyers” program allows third-party ad vendors to deliver ads by participating in ad auctions on Google’s ad exchange.

Yandex, although much smaller in revenue, similarly dominates the digital advertising ecosystem in Russia and some other regions. It also provides both an ad exchange and systems for ad sellers and buyers.

Beeswax, Owned by Freewheel/Comcast

Beeswax is a major US-based ad buying platform, since 2021 owned by Comcast’s ad platform FreeWheel. It offers a Demand-Side Platform (DSP) that helps advertisers and other ad vendors deliver targeted ads to users by participating in ad auctions. Its “bidder-as-a-service” product is considered highly customizable and imposes fewer restrictions on its clients than other DSPs.

The FreeWheel website states that, by using Beeswax’ ad buying platform rather than other DSPs, clients could “access the full, unfiltered stream of RTB events, in much the same way [they] would if [they] were building a bidder from scratch”. Clients can augment the stream of ad bidding data they receive, for example, by “mapping” users to “rich profiles”, and they can use custom bidding algorithms and targeting attributes.

While this appears to offer great flexibility to clients to an extent that may come close to operating their own DSP, FreeWheel takes care of the integrations with ad exchanges and Supply-Side Platforms (SSPs) that help app and website publishers sell ads. As of July 2026, the FreeWheel website lists integrations with 36 “supply partners” including Google, Amazon, Microsoft, Index Exchange, and many others.

Beeswax is listed as an approved TCF ad vendor by IAB Europe (vendor list). Google lists Beeswax as a certified ad vendor and among its “common” European ad technology partners which Google will use by default when publishers do not set up a custom list of ad vendors. For its ad serving and third-party tracking, Beeswax uses the domain bidr[.]io and the cookie identifier bito (devicedisclosure.json).

Eskimi, a White-Label DSP Based in Lithuania

Eskimi is a digital advertising group based in Lithuania with offices in Greece, Turkey, Japan, United Arab Emirates, Indonesia, Bangladesh, Nigeria, and Kenya, according to its website, eskimi.com. Its ad buying platform Eskimi DSP, which allows its clients to target 1.5 billion “profiled users” across 60 ad exchanges, according to the company, is also offered as a “white-label” version that “enables agencies, ad networks, and businesses to offer ‘Eskimi DSP’ under their own brand”. Eskimi also provides a data management platform (DMP) that “collects and stores data” it receives from 50 ad exchanges, amounting to two2 billion profiles, according to a 2025 version of the company’s website. Its website and Lithuanian company records show that it is incorporated as “UAB Eskimi”, also known as “UAB Aktyvus sektorius”.

Eskimi is much lesser known than Beeswax. Except for two paid posts, we did not find any articles discussing the company on digital advertising trade press sites like Adweek, Digiday, and AdExchanger. Eskimi was, however, prominently discussed when US-based data broker Datastream Group told U.S. Senator Ron Wyden that Eskimi was the source of 3.6 billion location data records revealing the exact movements of millions of people, including U.S. military and intelligence personnel, as reported in a joint investigation by German netzpolitik.org and other outlets. This investigation has helped spark extensive debates about ad surveillance.

While German netzpolitik.org found several additional links between the analyzed data and the company, Eskimi denied that it was the source of the data. Google told 404 Media that Eskimi is “part of Google’s Authorized Buyer program and must abide by our policies”. It added that it “regularly audits its Authorized Buyers program participants”. Eskimi is closely linked to the location data broker Redmob, which claims to sell data on one billion people across 150 countries according to its website, redmob.io. While Redmob is incorporated in Dubai, netzpolitik.org found that Eskimi and Redmob share the same CEO, who responded to their questions about Eskimi from a Redmob email address.

As of July 2026, Eskimi is listed as an approved TCF ad vendor by IAB Europe (vendor list). Google lists Eskimi as a certified ad vendor and among its European ad technology partners.

Vungle, Liftoff’s SSP, and Ad Exchange

Vungle was a mobile advertising firm that merged with the U.S.-based mobile advertising firm Liftoff, which went public in June 2026. Since the merger, Liftoff offers several Vungle-branded products including a Supply-Side Platform (SSP) named Monetize, which helps app publishers sell ads, and the mobile ad exchange Vungle Exchange, which helps marketers buy ads served in mobile apps.

Both the SSP and the ad exchange rely on the Vungle SDK, which is a piece of advertising and tracking software embedded in many Android, iOS, Amazon, Windows, and Unity apps. The Vungle SDK is embedded in 150,000 mobile apps used by one billion people across 150 countries, which also describes the number of users that can be targeted via the Vungle ad exchange, according to the company.

Guidelines for the Vungle ad exchange contain a rule that asks clients to “refrain from” using the platform for the distribution of “malware, spyware, and files that can harm or gain unauthorized access to a device or user information”. We did not find an explanation of how the company monitors and enforces this rule.

Vungle has been controversially discussed in several papers and reports on mobile tracking and privacy. The Norwegian Consumer Council found in 2020 that Vungle received GPS coordinates and other personal data on users of Grindr and another mobile app, seemingly without a legal basis under the GDPR.

As of July 2026, Liftoff’s “Monetize” and “Vungle Exchange” products are listed as approved TCF ad vendors by IAB Europe (vendor list). Google lists Liftoff’s DSP and Monetize products as certified ad vendors and it lists Liftoff among its “common” European ad technology partners that Google will use by default when publishers do not choose a custom list of ad vendors.

Google has been deeply interconnected with Vungle from its inception. Google Ventures was an investor in Vungle’s seed, series A, and series B funding rounds. The Norwegian Consumer Council pointed out in 2020 that Google’s mobile advertising system AdMob “provides Vungle with access to extra features that allow Vungle to bypass data filters, and thus send more data to its partners than what would ordinarily be possible through Google’s regular advertising tools”. As of July 2026, Liftoff’s Vungle product Monetize is listed among a few “premium bidding partners” in Google’s mobile advertising system AdMob and among a few “ad sources” for AdMob’s advertising services on Android and iOS.

Sunteng, a Chinese SSP, DSP, and Ad Exchange

The Chinese digital advertising firm Sunteng provides ad buying and selling services for both advertisers and publishers, as well as a “programmatic marketplace”, i.e. an ad exchange, according to its website, sunteng.com. The site also refers to the company as “Shunfei Technology”. The link to Sunteng’s DSP offering leads site visitors to biddingx.com (“BiddingX”), an entity that promotes itself as China’s largest DSP. Sunteng appears to operate also under the brand Bidex (bidex.cn), which focuses on “overseas programmatic”, i.e. on digital advertising services for non-Chinese clients. We assume that Sunteng, Shunfei, Bidex and BiddingX are part of the same Chinese group of companies with offices in Singapore and the US. Sunteng claims to process 50 billion ad bid requests a day across 10,000 mobile apps and 60 ad vendor partners, and it lists Eskimi as a partner.

As of July 2026, Google lists biddingx.com (“Shunfei Infomation Technology Corporatio” [sic]) as a certified ad vendor. IAB Europe listed bidex.cn (“Sunteng Hong Kong Holdings Limited”) as an approved TCF ad vendor until December 2025 (vendor list).

Xandr, aka Microsoft Advertising

Xandr, formerly known as AppNexus, has long been a major player in digital advertising. After Microsoft acquired it from AT&T in 2022, it became part of Microsoft Advertising in 2023. While Microsoft shut down Xandr’s ad buying system, the “Invest” DSP, in early 2026, it continues to offer Xandr’s ad selling system, the “Monetize” SSP. Ad buyers who used the former Xandr DSP were “handed” to Amazon DSP, according to trade press reporting.

As shown in Section 6, Microsoft’s user ID syncing in the browser via the domain adnxs[.]com, which assigns a Microsoft user ID to people who visit the sites of ad sellers and maps it to user IDs assigned by other ad vendors, appears to remain operational as of June 2026. Xandr has long been operating massive identity databases. In 2020, when Xandr was still owned by AT&T, it reportedly operated an identity graph linking 5 billion identifiers.

As of July 2026, Microsoft’s ad system Xandr is listed as an approved TCF ad vendor by IAB Europe (vendor list). Google’s list of certified ad vendors contains four records for Xandr. Google also lists Xandr among its “common” European ad technology partners which Google will use by default when publishers do not choose a custom list of ad vendors.

Appendix B. Glossary

Adtech vendor, ad vendor. Advertising technology intermediary such as a Demand-Side Platform (DSP), Supply-Side Platform (SSP) (both defined below) or ad exchange.

Ad Slot. Designated space or position on a website or mobile app reserved to display an ad.

Demand-Side Platform (DSP). System operated by an adtech intermediary that helps advertisers buy ad placements across many different websites or mobile apps in an automated way by participating in real-time auctions hosted by ad exchanges.

Supply-Side Platform (SSP). System operated by an adtech intermediary that helps publishers of websites or mobile apps sell ad slots in an automated way by participating in real-time auctions hosted by an ad exchange, which is often operated by the same ad vendor as the SSP.

Ad Exchange. Automated marketplace operated by an adtech intermediary that hosts real-time auctions which facilitate the selling of ad slots and the buying of ad placements across many publishers, advertisers and intermediaries like DSPs and SSPs. Ad exchanges are often operated by SSPs.

Real-Time Bidding (RTB). Automated high-frequency auctions hosted by ad exchanges where advertisers (or DSPs on their behalf) bid on ad placements offered by website and mobile app publishers (or their SSPs). When a user visits a website or uses an app that sells targeted ads via RTB, the publisher’s SSP initiates a bid request that transmits data about the user and the ad slot to several DSPs, who submit bids on behalf of advertisers. The ad exchange determines the winner of the auction and pushes the ad to the user.

Bid Request. RTB auction record that describes an ad slot and the user who currently visits a website or uses a mobile app. Bid requests are initiated by publishers and sent via an SSP and an ad exchange to several DSPs, which place bids in order to show ads to specific users on behalf of advertisers. Bid requests typically contain personal data about users in order to facilitate targeted advertising.

Mobile Advertising ID (MAID). Unique identifier for a mobile device used for advertising and tracking purposes, assigned by the device’s operating system such as Google Android or Apple iOS. While users can reset or delete mobile ad IDs in the settings, they are activated by default. Advertising and data companies use mobile ad IDs to link user data across contexts and vendors in order to track, follow, profile and target users.

Cookie ID. Unique identifier for a user’s web browser, typically stored and retrieved in the browser by third-party code operated by adtech vendors during website visits.

Appendix C. Domains linked to Discover-Tech and Controlium

General

We assess that the following domains are – or have been – linked to Discover-Tech and Controlium:

*.discover-tech[.]io
*.mtrtb[.]com
*.mydsp[.]io
*.controlium[.]net
*.powerium[.]net
*.platc-tester[.]com
*.myweb3id[.]io
*.myipinfo[.]io
*.akedo[.]gg
*.volasim[.]com

*.discover-tech[.]io
*.mtrtb[.]com
*.mydsp[.]io
*.controlium[.]net
*.powerium[.]net
*.platc-tester[.]com
*.myweb3id[.]io
*.myipinfo[.]io
*.akedo[.]gg
*.volasim[.]com

NOAS Servers

According to our analysis, Discover-Tech operates – or has operated – the following NOAS servers as part of its Controlium platform:

noas.mtrtb[.]com/getAd
infinoas.mtrtb[.]com/getAd
ppv2.mtrtb[.]com/getAd
pqv2.mtrtb[.]com/getAd
events.platc-tester[.]com/cplatform/getAd
events.myweb3id[.]io/cplatform/getAd
noas.powerium[.]net/getAd
qa-noas.powerium[.]net/getAd

noas.mtrtb[.]com/getAd
infinoas.mtrtb[.]com/getAd
ppv2.mtrtb[.]com/getAd
pqv2.mtrtb[.]com/getAd
events.platc-tester[.]com/cplatform/getAd
events.myweb3id[.]io/cplatform/getAd
noas.powerium[.]net/getAd
qa-noas.powerium[.]net/getAd

Additional NOAS domains that appear to be associated with Discover-Tech:

noas.adtimizer[.]co
noas.impchkdsp[.]com
noas.trakking[.]co

noas.adtimizer[.]co
noas.impchkdsp[.]com
noas.trakking[.]co

Ad Tracking Domains

We assess that the following additional domains are – or have been – associated with Discover-Tech’s ad tracking or targeting:

tracookiepixel[.]xyz
cookiesurfer[.]com
cookie-sync[.]xyz
ads-monitor[.]xyz
checkmyimp[.]com
ads-impressions[.]com
nutralove[.]co

tracookiepixel[.]xyz
cookiesurfer[.]com
cookie-sync[.]xyz
ads-monitor[.]xyz
checkmyimp[.]com
ads-impressions[.]com
nutralove[.]co