Citizen Lab and ad-security firm Confiant dropped a report on October 15, 2026, that put hard technical evidence behind a familiar pattern. An Israeli company called Discover-Tech bought ordinary online ads, then used them to profile devices and, in confirmed cases, deliver zero-click spyware from Candiru (later rebranded Integrity Labs). No click required. The ad loads and the attack starts.
- At least 45 devices at Al Jazeera were targeted and infected in 2024–2025. Citizen Lab tied the malware with high confidence to Candiru, which the U.S. Commerce Department blacklisted in 2021 for selling tools used against officials, journalists, and activists.
- The same Discover-Tech ads showed up on networks used by the Pentagon, NATO, the International Atomic Energy Agency, the International Criminal Court, Raytheon, Nvidia, Microsoft, and others. Seeing an ad does not prove infection, but it does mean profiling at minimum. Researchers reviewed billions of ad-bidding records covering roughly 120,000 websites and 75,000 apps.
- Google and industry body IAB Europe had listed Discover-Tech as an approved vendor for years. Both later removed it after the investigation. Candiru’s assets had already been acquired by U.S. firm Integrity Partners and moved into a new entity to sidestep the U.S. blacklist.
Israeli cyber firms routinely recruit from Unit 8200, the IDF’s signals-intelligence and cyber unit. That pipeline has produced commercial spyware companies for years. The tools get sold to governments, including clients who use them against journalists and political targets. Al Jazeera is one documented case. Citizen Lab did not name the end customer for the Al Jazeera infections.
🇮🇱 An Israeli company allegedly turned ordinary ONLINE ADS into a massive global surveillance network…
Cybersecurity researchers found that Discover-Tech used ads appearing across more than 120,000 websites and 75,000 apps to identify and track users.
Sometimes even extracting phone numbers without requiring anyone to click.
Researchers say the system also helped Israeli spyware firms target devices, with malicious ads appearing on networks linked to the Pentagon, NATO, UN, European Commission, and International Criminal Court.
Google has now removed Discover-Tech from its advertising platforms.
Israeli things… as always 😅
Writer: Samuel
— Mario Nawfal (@MarioNawfal) October 15, 2026
Pentagon Raised the Espionage Threat to “Critical”
In June 2026 the Defense Intelligence Agency elevated Israel’s counterintelligence threat level to critical—the highest rating. NBC and the New York Times reported the assessment followed incidents of software installed on phones of U.S. personnel in Israel and stepped-up efforts to listen in on senior American officials involved in Iran talks, including envoy Steve Witkoff and Pentagon policy officials Elbridge Colby and Michael DiMino.
- The U.S. and Israel have long spied on each other. Allies do that. The Pollard case in the 1980s remains the clearest example of the scale and damage possible. Recent reporting describes a sharper push tied to disagreements over Iran policy.
- Israel’s embassy has denied gathering intelligence on the United States or its officials, saying its collection focuses on enemies, not allies. U.S. officials quoted in the reporting treat the activity as having crossed the normal tolerance line between partners.
Incase you missed it yesterday, an Israeli marketing firm used website ads to distribute spyware created by Israeli developer Candiru and all it took for it to infect people’s phone was visiting a website with the infected ads on it and then allowing the ad to load on the page.
There are potentially hundreds of millions of people with Israeli spyware on their phones right now and they have no clue.
— Mel (@Villgecrazylady) October 16, 2026
Deeper Tech Integration Moves Forward Anyway
While the counterintelligence warning was circulating, Congress kept language in the defense bill that would formalize broader U.S.-Israel defense technology cooperation. Section 224 (later renumbered) of the FY2027 National Defense Authorization Act directs the Pentagon to create an executive agent for joint research, co-production, licensing, and integration across AI, autonomous systems, cyber, biotechnology, missile defense, and data fusion.
- Supporters argue the United States gains access to Israeli innovations that have already moved faster in some operational areas. Israel has used AI-assisted targeting systems such as Lavender and Gospel in Gaza at high tempo. The U.S. has its own Project Maven (Palantir) platform that fuses sensor data for targeting and has been used in operations against Iran and elsewhere. Palantir has also worked with the Israeli military.
- Critics, including Reps. Thomas Massie and Ro Khanna, say the provision creates tighter industrial and data ties than the United States maintains with any other country and would be hard to unwind. They note the risk that sensitive U.S. systems and data become more exposed to a partner whose espionage activity the Pentagon itself has rated critical.
Raytheon and Israeli firm Rafael already operate a joint venture that produces Iron Dome interceptors in Arkansas. The U.S. has funded large parts of Iron Dome for years; the partnership has produced American manufacturing and a U.S. Marine Corps variant. Past efforts to transfer full Iron Dome source code to the U.S. Army ran into Israeli restrictions on the code.
BREAKING: Israeli spyware is confirmed on our phones. This should be headline news but none of our mainstream media is covering it, of course. So we will.
An Israeli ad company called Discover-Tech used ordinary online ads to plant spyware on people’s devices, and nobody had to click anything. The ad just had to load on a website or inside an app for you to be infected.
Citizen Lab and the ad security firm Confiant published the findings yesterday. Researchers went through roughly 4 billion ad-bidding records and found Discover-Tech ads running on more than 120,000 websites and 70,000 apps between March and June of this year. Confiant says the company was serving at least 10 million ads a day.
The platform was called Controlium. According to Citizen Lab, it let spyware companies use ad auctions to profile and unmask users, then send an infected ad to the one person they wanted to hack. The ads were also pulling cookies and login tokens from the sites they ran on. Israeli corporate records list Dekel Boni as the company’s founding director and sole shareholder.
The main spyware customer was Candiru, the Israeli firm the U.S. government blacklisted in 2021, which now goes by Integrity Labs. Five years after that blacklisting, it was still reaching devices through ad inventory on Google, Comcast-owned Beeswax and Russia’s Yandex. Google had Discover-Tech on its approved vendor list from 2020 until this week.
At least 45 Al Jazeera devices were targeted in 2024 and 2025. Candiru’s 2021 shareholder filings reportedly listed a minority investor described as a proxy for Qatar’s sovereign wealth fund, and Qatar also funds Al Jazeera. If that holds up, Qatari state money was sitting inside the company whose spyware was later aimed at Qatar’s own news network.
The heaviest targeting was in the Palestinian territories, where Discover-Tech served almost 2% of all digital ads and about 10% on April 7. Traffic also reached the Armenian prime minister’s office, courts, universities and defense organizations.
Google and the other ad platforms cut Discover-Tech off after the report came out. What nobody has answered yet is who paid for the ad buys, and how a company working with a U.S.-blacklisted spyware vendor passed vendor review for six years.
I am going to look into this today to see if we can figure out who was buying the ads. Interesting timing considering my article yesterday….
Here’s what to do to protect yourself:
(1) Use an ad blocker. Citizen Lab calls ad-blocking a cybersecurity best practice and says there is no consistently safe way to be exposed to targeted ads. On iPhone, add a Safari content blocker. On Android, use Brave or Firefox with uBlock Origin. Ad blockers only work in your browser, not inside apps, so it also helps to delete free ad-supported apps you don’t need.
Kill your advertising ID.(2) iPhone: Settings > Privacy & Security > Tracking, and turn off “Allow Apps to Request to Track.” Then Settings > Privacy & Security > Apple Advertising, and turn Personalized Ads off.
(2) Android 12 or later: Settings > Privacy > Ads > Delete Advertising ID. Then in Settings > Google > All Services > Privacy & security > Ads > Ads privacy, turn off Ad topics and Ad measurement.
(3) Windows 11: Settings > Privacy & Security > General, and turn off personalized ads using your advertising ID.
(4) Update your phone and restart it often. Many zero-click exploits don’t survive a reboot, so a daily restart forces attackers to reinfect you.
Stay tuned!
— theleahfiles (@leahfiles) October 16, 2026
Nuclear Command Modernization and the SkyNet Claim
On October 13, 2026, the Air Force awarded Raytheon a sole-source contract with an $8 billion ceiling to modernize Strategic Communications Terminals for the Nuclear Command, Control, and Communications (NC3) system. The work runs through 2036 and covers secure links between national command authority and nuclear forces. Initial funding was modest; the rest comes as orders are placed.
The Substack piece that triggered this discussion ties the Discover-Tech ads appearing on Raytheon networks to the new nuclear contract and the existing Rafael partnership, arguing it effectively hands Israel influence over U.S. nuclear command systems. That leap is not supported by the technical reports. Citizen Lab and Confiant documented ads reaching those networks; they did not document successful infection of nuclear command systems or prove control of them. Nuclear modernization does move more systems toward internet protocols, which raises cyber risk from any sophisticated actor. That risk exists independently of the specific Israeli spyware campaign.
The Practical Balance
The U.S.-Israel relationship delivers concrete military advantages: shared threat intelligence on Iran and its proxies, advanced missile defense that has been combat-tested, and rapid innovation in drones, AI targeting, and cyber tools. Those capabilities have real value for American forces.
At the same time, the commercial spyware industry, the documented zero-click ad vector, the elevated Pentagon threat assessment, and the push for permanent technology integration create friction. Allies spy. The question is whether the current tempo and the depth of systems integration stay inside the bounds the United States can accept when its own counterintelligence shop has already flagged the risk. Commercial tools sold by Unit 8200 alumni make the problem harder to contain, because the same code can be pointed at journalists one day and government networks the next.
Whatfinger News has tracked the broader defense and technology picture at https://militarywar.whatfinger.com/. The October reports add a concrete technical case to a long-running debate about how tightly the two countries should fuse their military industrial and intelligence systems.
—- The Whatfinger News Team: Sgt K, Luke – with Grok on edits
Top Features and Vids across Whatfinger
- Democrat Fraud: Inside Recent Federal Raids as Agents Make Arrests Across the US
- Paris Cost-of-Living Protests Descend Into Riots as Man in Full Batman Suit Joins Clashes
- Guns are the answer: Dearborn Woman With Carry Permit Stops Attack on Boyfriend. Prosecutors Clear Her
- ‘ESCALATING TENSIONS’: Trump REFUSES Iran talks as ‘PERFECT STORM’ brews as 100 Days of the blockade is today
- Democrat Wealth tax BACKFIRES, Facebook IS COOKED, $27B LOSS IN CA
- SNAP Scammers RAGE As Immigrants STEALING Food Stamps Busted
- The West Still Hasn’t Buried Communism. That’s Why the Left Keeps Winning. Time To Act!
