What you can do right now:
— use an ad blocker. uBlock Origin in Firefox or Brave on desktop. on iPhone: use a Safari content blocker.
— ad blockers only work in browsers, not inside apps. delete free ad-supported apps you don't use.
— kill your advertising ID:
iPhone: Settings → Privacy → Tracking → turn off "Allow Apps to Request to Track"
Android: Settings → Privacy → Ads → Delete Advertising ID
Windows 11: Settings → Privacy & Security → General → turn off personalized ads
— restart your phone daily, many zero-click exploits don't survive a reboot. forcing attackers to reinfect you is a real defensive measure.
...
Let me tell you about what has to be one of the most important surveillance story of 2026.
An Israeli company called Discover-Tech used online advertising to deliver spyware.
Requires no click, the ad just had to load.
Real-time bidding is the auction that decides which ad you see in the milliseconds before a page loads. Discover-Tech participated in those auctions on Google, Comcast's Beeswax, and Russia's Yandex.
When Discover-Tech won a bid, their ad loaded, the ad contained a script that immediately called back to their servers, transmitting your device's ad ID and IP address.
that data fed into a platform called Controlium. Controlium let spyware customers identify specific individuals inside that mass of ad traffic and fire an infected ad at only them.
the spyware was Candiru's, now rebranded as Integrity Labs. US government blacklisted in 2021 but still operating.
3.77 billion ad bids. 120,768 websites. 75,373 apps. 161 countries from march through june 2026 alone at least 10 million ads per day.
Confiant's cofounder: "very likely hundreds of millions of people would have been touched by Discover-Tech."
The US Department of Defense. NATO. the United Nations. the European Parliament. the European Commission. the Armenian prime minister's office. courts and universities in the Palestinian territories, where Discover-Tech served roughly 2% of all digital ads and 10% of ads on April 7, 2026.
Candiru's 2021 shareholder filings reportedly list a minority investor described as a proxy for Qatar's sovereign wealth fund. Qatar also funds Al Jazeera. if that connection holds: Qatari state money was sitting inside the company whose spyware was later used to compromise Qatar's own news network.
...