Citizen Lab says an ad vendor listed in IAB Europe’s Transparency and Consent Framework served the ads that delivered zero-click spyware to Al Jazeera devices. In Report 195, published on 15 October, the lab names the vendor as Israeli company Discover-Tech. For sites that run consent banners, the case is about the registry: Discover-Tech sat on IAB Europe’s Global Vendor List as vendor 778 from July 2020 until 8 October.
Al Jazeera and the Controlium Platform
Citizen Lab calls the technique AdFection. It says Discover-Tech runs a platform called Controlium, which lets its partners “de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered”.
The researchers link, with high confidence, a series of 2024 and 2025 zero-click attacks on Al Jazeera to Candiru spyware delivered through Discover-Tech’s ads. At least 45 devices at Al Jazeera were targeted, the report says.
Discover-Tech did not respond to Citizen Lab. According to TechCrunch’s write-up of the Discover-Tech spyware findings, the lab did not determine which governments were behind the attacks.
3.77 Billion Bids, Different Bases
Citizen Lab found two world-readable Apache Druid databases on a Discover-Tech website. Between March and June 2026, Discover-Tech’s MyDSP bid on 3,770,286,576 impressions and appeared to win 441,954,291, or 11.7%.
The bases differ, so the numbers should not be mixed. About 19% of all bids, at least 718,748,885, were for ads that apparently carried a script tag pointing to a “NOAS” server, which the report identifies as a vector for spyware delivery. Exchange shares are shares of all MyDSP bids, not of those 19%: Yandex 67.4%, Google Ad Manager 24.74%, Vungle 7.24%.
The Druid data held no cookie IDs, advertising IDs or GPS coordinates. It did hold IP addresses or /24 ranges and city-level geolocation, the report says.
What did Discover-Tech’s TCF entry ask users to consent to?
In version 179 of the Global Vendor List, the last version that listed Discover-Tech as active, the entry for vendor 778 asked for consent under purposes 2, 3, 4 and 7: selecting ads with limited data, creating and using profiles for personalised ads, and measuring advertising performance. It declared IP addresses and device identifiers as its data, plus Feature 3, which identifies devices from information transmitted automatically. Citizen Lab says Discover-Tech’s inclusion in the Google and IAB Europe lists potentially means that a click on “Agree” in a consent request could be construed as authorizing Discover-Tech to process a European user’s data under the GDPR.
The same live entry set the file’s “usesCookies” field to false. Citizen Lab says Controlium customers could select a target by “browser identifier (MyDSP or Beeswax cookie ID)”, as well as by mobile advertising ID or IP address.
Version 180, published on 8 October, holds a longer record for vendor 778 next to its deletion date: it adds purpose 1, cookie use and non-precise location data, among other fields. The file does not say who changed the entry or why.
Google added the same Feature 3 to its own TCF registration for IP-based ad personalization in the EEA, as we covered in Google’s IP-based ad personalization under TCF Feature 3.
The Vendor List Records the Removal
The GVL file records the removal directly. Version 179, updated 1 October, still lists vendor 778. Version 180, updated 8 October at 16:00 UTC, carries a deletedDate of 2026-10-08 13:57 UTC for the same entry.
Citizen Lab gives the listing as 2 July 2020 to 8 October 2026 and says the removal came “as a result of this investigation”. Google also removed Discover-Tech from its vendor registries and cut its access to Google’s ad exchange platforms. Beeswax removed Discover-Tech from its ad buying platform, Eskimi blocked Discover-Tech’s accounts and domains, and Vungle paused Discover-Tech’s access for a review.
IAB Europe removed the vendor but did not respond to Citizen Lab’s request for comment. Xandr did not respond either. Citizen Lab adds that when Discover-Tech’s tracking pixel geolocates a visitor to a GDPR region, it processes TCF consent signals for three vendors: Discover-Tech, Xandr and BeeswaxIO. Xandr was recently fined by Norway’s regulator, as we reported in the Xandr fine over Grindr data.
“Largely Based on Self-Attestation”
Citizen Lab says the Google and IAB Europe lists “appear to be largely based on self-attestation by vendors”. It notes they are also the basis for most consent pop-ups shown in Europe. According to IAB Europe, as quoted in the report, it takes “reasonable steps to vet and approve” vendor applications.
The lab also says Discover-Tech holds a “Verified by TAG” badge as of October 2026. That is Citizen Lab’s claim, and we have not checked it.
Citizen Lab’s recommendations are specific:
- Introduce mandatory third-party audits for “certified” or “approved” vendors.
- Evaluate legislation to remove personal data from real-time bidding auctions.
- Block ads and tracking on devices and at the gateway, and opt out of ad targeting on company-issued devices.
Citizen Lab researcher Bill Marczak said Discover-Tech is “surely just the tip of the iceberg”, TechCrunch reported. For consent teams, the report’s own wording sets the limit of a listing: the industry, Citizen Lab says, appears to rely on “self-attestation where vendors check a box on an online form”.