An Israeli spyware operation silently infected devices connected to three of Italy’s most sensitive institutions—the central bank, the Ministry of Defense, and the national parliament, according to research published by the University of Toronto’s Citizen Lab in coordination with ad security firm Confiant.
The company at the center of the scandal is Discover-Tech, which operated a platform called Controlium. According to investigators, the system was capable of silently infecting phones without a click—no malicious link, no phishing email, no user interaction of any kind.
Discover-Tech presented itself as a legitimate player in digital advertising, appearing on approved vendor lists maintained by Google and IAB Europe.
Behind that facade, Controlium allowed operators to select targets using identifiers as ordinary as IP addresses, advertising IDs, and browser cookies.
When a targeted device loaded a webpage or app carrying a Discover-Tech ad slot, the platform would deliver an ad impression. For most users, nothing happened.
For selected targets, the impression carried malicious code that silently connected to infrastructure associated with Candiru, an Israeli spyware vendor sanctioned by the U.S. Commerce Department in 2021 and reportedly rebranded as Integrity Labs.
The entire process could unfold within seconds. Citizen Lab dubbed the technique “AdFection.”
Israeli spyware companies have built a global surveillance industry that operates with the quiet approval of the state, selling intrusion tools to governments that use them against journalists, activists, opposition politicians, and even American institutions.
The Citizen Lab’s recent findings on Discover-Tech—whose advertising-based “AdFection” system exposed networks belonging to Italy’s central bank, defense ministry, and parliament—represent only the latest chapter in a much longer pattern.
Before Discover-Tech, there was NSO Group’s Pegasus, licensed to roughly 45 governments and implicated in the targeting of French President Emmanuel Macron, Saudi journalist Jamal Khashoggi’s associates, and Indian opposition leader Rahul Gandhi.
Then came Paragon Solutions’ Graphite, which Italian intelligence services admitted using against NGO founders, while journalists received alerts that they too had been targeted.
What connects these cases is not merely the Israeli origin of the technology, but the architecture of impunity surrounding it: Israel’s Defense Ministry oversees export licenses and has repeatedly cleared companies of wrongdoing, while Israeli authorities have declined to cooperate with foreign investigations seeking accountability.
The result is a system in which the tools are Israeli, the oversight is Israeli, and the accountability stops at Israel’s border—leaving institutions from Rome to Washington to examine their own networks and wonder what, exactly, passed through them.