Обычные онлайн-рекламные объявления, закупленные израильской компанией, попали в сети, принадлежащие Центральному банку Италии, министерству обороны и парламенту этой страны. Уже было доказано, что эта же система не приносит никакой прибыли (zero-cl ...
Сообщение Planet-Today.com. Перевод заголовка и краткого описания выполнен автоматически.
Ordinary online ads bought by an Israeli company reached networks belonging to Italy’s central bank, its defense ministry, and its parliament. The same system has already been shown to deliver zero-click spyware without any click from the user. The confirmed infections so far are at Al Jazeera. The question for Italian institutions is whether any of their own devices followed the same path.
On 15 October 2026 the University of Toronto’s Citizen Lab published a detailed report titled “Exposing AdFection.” Researchers showed, for the first time in public technical detail, that mercenary spyware can be delivered through targeted online advertisements. They called the method AdFection. At the center sits Discover-Tech, an Israeli firm that presented itself as a normal advertising company while operating a platform called Controlium. That platform let partners select devices by advertising ID, cookie, or IP address and then push malicious code the moment an ad loaded. No link click, no email, no user action was required.
What Citizen Lab Actually Found
The clearest confirmed case involves Al Jazeera. Citizen Lab stated with high confidence that at least 45 devices inside the network were targeted in 2024 and 2025 and infected with spyware from Candiru, an Israeli vendor placed on the U.S. Commerce Department Entity List in 2021 and later reported under the name Integrity Labs. Network logs showed the sequence: a Discover-Tech ad impression, contact with a Candiru validator server within seconds, then command-and-control traffic. A recovered Windows file matched earlier Candiru samples.
The same bidding data showed Discover-Tech ads appearing on far more sensitive networks. Citizen Lab listed Italy’s Bank of Italy (the central bank), the Camera dei deputati (the lower house of parliament), and the Ministry of Defense among them. The same lists include NATO networks, United Nations networks, European Parliament and Commission systems, multiple Nordic defense and critical-infrastructure operators, Israeli ministries themselves, semiconductor firms such as Intel and Nvidia, and many others. In four months of examined data (March–June 2026) the company placed roughly 3.77 billion bids and won about 442 million auctions across nearly 200,000 websites and apps.
“An ad impression does not by itself confirm targeting or infection,” Citizen Lab wrote. The presence of the ads on Italian institutional networks means devices on those networks were exposed to the delivery mechanism. It does not prove that specific Italian officials or systems were successfully compromised. The researchers called for urgent investigation to determine whether any infections occurred.
Google removed Discover-Tech from its approved vendor lists and terminated its access to ad-exchange platforms. IAB Europe suspended it as well. Ad-security firm Confiant published a parallel investigation the same day confirming the advertising-side findings.
How the System Worked
Modern online advertising runs on real-time bidding. When a page or app loads, dozens of companies bid in milliseconds for the right to show an ad. Discover-Tech used this normal commercial process. Its Controlium console let customers upload lists of mobile advertising IDs or IP addresses. For most viewers the ad was harmless. For a selected target the same ad slot carried JavaScript that contacted Discover-Tech or Candiru infrastructure and could install spyware without further interaction.
The ads themselves usually contained no obvious malware. The malicious payload arrived only for the chosen devices, which helped the activity evade automated scanning by the advertising platforms. Citizen Lab noted that Discover-Tech showed little evidence of ordinary advertising business; the scale of bidding and the customer list pointed to a specialized role linking spyware vendors to the ad ecosystem. Other linked actors included the Israeli firm Bindecy and the advertising-intelligence company Intelos.
Italy’s Longer Spyware Record
This is not Italy’s first encounter with Israeli-origin surveillance tools. In 2025 the parliamentary intelligence oversight committee COPASIR confirmed that Italian intelligence services had used Graphite spyware from the Israeli company Paragon Solutions against a limited number of targets, including members of the migrant-rescue group Mediterranea. The government said the use was authorized by prosecutors and related to irregular migration, alleged terrorism, and organized crime. WhatsApp and later Italian prosecutors also documented infections of a journalist and the same activists. Italy ended the Paragon contracts after the public outcry.
Separately, police wiretaps in the Equalize private-investigation scandal recorded meetings in Milan between Italian operators and Israeli agents discussing a million-euro task involving Russian financial flows and Wagner Group-related accounts. Italian media and Politico reported the claims; Israeli authorities have not publicly confirmed the details. Candiru itself has a documented history of targeting journalists, activists, and officials; the U.S. sanctions in 2021 cited exactly those categories.
Italy is also a major domestic user of spyware. Local firms and cheaper commercial tools have been deployed by prosecutors for years, with thousands of authorized infections reported in some years. High-end Israeli products sit alongside that domestic market rather than replacing it. Readers who want more context on Israeli technology in consumer devices can examine iPhone 17e Israeli Chips: What Apple Confirmed vs. Viral Claims. Broader surveillance-tech questions appear in Satellogic Merlin Satellites Stir Palantir Surveillance Debate and FalcoNet Spy Vans: What Texas Police Bought and Why It Matters.
Oversight, Export Controls, and Accountability
Israeli Defense Ministry export licenses govern the sale of these tools. The ministry has repeatedly stated that companies comply with the rules and that the tools are sold only to approved government customers for serious crime and national-security purposes. In practice, foreign investigations have often received limited cooperation. When misuse is alleged, the response is frequently that the customer, not the vendor, bears responsibility. Paragon, for example, publicly ended the Italian relationship after the scandal; the company has positioned itself as more selective than older competitors such as NSO Group.
Critics argue the structure creates a zone of limited accountability: the technology originates in Israel, the export license is Israeli, and foreign prosecutors struggle to obtain data or testimony. Supporters note that many Western governments, including Italy, the United States, and several European states, have purchased the same class of tools and that comparable products exist from non-Israeli vendors. Both observations can be true at the same time. The AdFection findings add a new layer: even without a direct government contract, an advertising pathway controlled by an Israeli firm was able to reach the networks of allied institutions.
What Remains Open
No public forensic evidence has so far shown successful infections inside the Bank of Italy, the Ministry of Defense, or the Italian parliament via AdFection. Citizen Lab’s confirmed infections remain those at Al Jazeera. The ads’ presence still demonstrates that the infection pipeline was available on those networks. Whether any specific device was selected, whether any exploit succeeded, and who the ultimate customer was for any Italian targeting are questions that only further investigation can answer. Italian authorities have not issued a detailed public response to the Citizen Lab report as of early November 2026.
The larger pattern is harder to dismiss. A commercial advertising company listed for years by Google and IAB Europe turned out to be a conduit for a sanctioned spyware vendor. The same class of Israeli-origin tools has appeared in multiple European scandals involving journalists, activists, and, in some cases, political figures. Export controls and self-regulation in the advertising industry did not prevent the activity. Whether this reflects deliberate state policy, commercial opportunism by private firms with intelligence backgrounds, or both is a matter of interpretation. The technical evidence of the delivery method and the networks it reached is not.
Institutions that discovered Discover-Tech ads on their networks face a practical choice: treat the report as a prompt for internal forensic review, or wait for more definitive proof of compromise. History with earlier spyware families suggests that waiting often means the window for useful evidence closes.
Original source: Israel Caught Hacking Italy’s Central Bank, Defense Ministry, and Parliament—As Cyber Chaos Grips Nations Critical of Israel, The People’s Voice, 8 November 2026, full article. Primary technical source: Citizen Lab, “Exposing AdFection,” University of Toronto, 15 October 2026, executive summary and full report.
Disclaimer for fact-checkers: The People’s Voice is an alternative news site that aggregates and frames stories with a critical editorial stance toward official narratives. The core technical claims about Discover-Tech, Controlium, AdFection, Candiru, and the Italian institutional networks originate in the peer-reviewed-style research report by Citizen Lab, an established academic group at the University of Toronto with a long public record on spyware documentation. Readers should consult the primary Citizen Lab documents and the parallel Confiant investigation for the underlying data.
