Israeli spy firms are turning online ads into a weapon. Mexico is in their sights.

In just four months, an Israeli company tried more than 32 million times to place ads carrying spyware code in front of users in Mexico. Its ads reached Mexican government networks, an election authority and two news organizations. Nobody has to tap them: if the ad loads on the screen and the person is the target, their phone is infected.

The University of Toronto’s Citizen Lab documented it today, in the first public technical evidence of “zero-click” mercenary spyware delivered through advertising. The company is Discover-Tech, which presents itself as a digital advertising firm and, according to the report, works as a bridge between spyware companies and the ad market. Its system has already infected devices at Al Jazeera. Citizen Lab calls the technique AdFection.

I’ll say it plainly: Israel’s spying-for-hire industry is a direct threat to Mexican democracy, and it has already proven that here more than once. Pegasus spied on Mexican journalists. Team Jorge used fake profiles to defend a fugitive from the Ayotzinapa case. Now a company from the same ecosystem has Mexico among its top targets for poisoned advertising.

Here’s what’s inside:

• How the attack works. What Citizen Lab found and where it reached.
• What the report says about Mexico. Four findings, read carefully.
• An industry, not a one-off. The Israeli spyware and disinformation firms that have already operated in Mexico.
• Who is at risk and what to do. Steps for individuals, institutions and policy makers.

One ad is enough to infect a phone

Discover-Tech buys ad space on ordinary websites and apps through the same platforms any advertiser uses. Each ad carries a small piece of code that, when it loads, sends the device’s advertising identifiers to a company server. If the device belongs to a target, the server answers with malicious code. If not, it answers with nothing. To the ad platforms, the ad looks normal.

Customers can choose whom to attack by the phone’s advertising ID, the browser cookie or the IP address.

• Devices at Al Jazeera were infected with spyware from Candiru, another Israeli company, which now operates as Integrity Labs. At least 45 Al Jazeera devices were targeted. Citizen Lab attributes the attack to Candiru with “high confidence.”
• Between March and June 2026, Discover-Tech’s platform bid on more than 3.7 billion ad slots and appears to have won about 442 million.
• Ads carrying the attacker’s code appeared in 75,373 apps and 120,768 websites.
• Those ads reached networks at NATO, the European Parliament, the European Commission and governments in more than 20 countries. Confiant, the security company that worked with Citizen Lab, found signs of ads on networks of the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court.

Discover-Tech was listed as an approved vendor by Google and IAB Europe from 2020 to 2026. Google cut off its access to its ad exchanges only in early October.

What the report says about Mexico

Mexico shows up in four of the report’s findings.

Mexico ranks fifth by bids. Discover-Tech’s platform placed 32,675,229 bids to show ads carrying the attacker’s code to users whose connection is located in Mexico. Only Yemen, Pakistan, Montenegro and Brazil had more. The data covers only four months and one of the company’s three ad platforms, so the real number is higher.

Ads on Mexican government and election authority networks. Mexico is on the list of countries where Discover-Tech ads appeared on government-operated networks. The report also found ads on networks of election oversight bodies in Armenia, Indonesia and Mexico, and on the networks of two Mexican media organizations. It does not name any of these institutions.

A spyware customer that appears to have operated in Mexico. Citizen Lab identified a customer that appeared to be using Bindecy’s spyware in Mexico and Colombia. Bindecy is another Israeli company that sells surveillance tools to governments. The report could not determine where that customer was operating from.

Candiru’s sales team logged in from Mexico. Two accounts attributed to Candiru’s pre-sales team signed in to Discover-Tech’s control panel from several countries, Mexico among them.

The third point is the most serious. Citizen Lab found no evidence of legitimate ads in Discover-Tech’s data: zero conversions across millions of ads. It is a platform built to spy, and one of the spyware companies connected to it appears to have had an active customer in Mexico. The system is also built to leave no trace. It delivers the code only to the target, and according to Citizen Lab many infections showed no visible sign of tampering. If there are victims in Mexico, they most likely don’t know it yet. No one has yet published a forensic analysis of devices in Mexico like the one that exposed the attack at Al Jazeera, and until someone does, the lack of confirmation is not good news.

This is not an isolated case

Discover-Tech did not come out of nowhere. It belongs to an industry where the same names keep coming up.

• NSO Group sold Pegasus, the spyware used against journalists and human rights defenders in Mexico.
• Candiru is the spyware that infected Al Jazeera in this investigation. The United States put NSO and Candiru on its trade blacklist in November 2021 for supplying spyware that governments used against journalists, activists and officials.
• Bindecy and Intelos are connected to Discover-Tech according to the report. Intelos was founded by Eric Banoun, whom the Israeli newspaper Haaretz describes as one of the pioneers of Israeli offensive cyber, and who also sat on Discover-Tech’s board.
• Intellexa had its corporate network managed by Sara Hamou, who is linked to a company that was a Discover-Tech shareholder until March 2026. The US Treasury sanctioned Hamou and Intellexa’s founder in March 2024.
• Team Jorge and Archimedes Group manipulate conversations and elections with fake profiles.

Several of these companies were founded by former members of Israel’s security services. The state of Israel classifies Pegasus as a weapon, and exporting it requires a license from its Ministry of Defense. Tomás Zerón, who authorized Mexico’s purchase of Pegasus and faces charges in the Ayotzinapa case, lives in occupied Palestine, and the state of Israel has not extradited him. Mexico has every right to demand accountability from those who build these tools and from those who shelter their clients.

Spying and disinformation run on the same channels

AdFection is espionage. But Mexico has also been a target of Israeli social media manipulation firms, and the two are worth seeing together, because both depend on the same system of profiles and targeting.

Team Jorge. In February 2023, the journalism consortium Forbidden Stories exposed an Israeli group with no legal existence, led by Tal Hanan, that sells disinformation and hacking campaigns. Its tool, called AIMS, ran more than 30,000 fake profiles on social media. In front of the reporters, the group showed Gmail and Telegram accounts of people who did not know they had been hacked, and sent messages from them posing as the victims. It claimed to have worked on 33 presidential campaigns; Forbidden Stories notes that figure is hard to verify.

According to that investigation, AIMS bots defended Tomás Zerón in 2020. Zerón is accused of kidnapping, torture and tampering with evidence in the Ayotzinapa case. The fake profiles framed the charges as a campaign by the Mexican government against him. Zerón’s lawyer denied his client was responsible for that campaign.

Archimedes Group. In May 2019, Facebook removed 265 accounts, pages and groups run by this Israeli political marketing firm for coordinated inauthentic behavior. The network mostly targeted Africa and also Latin America; the DFRLab found Honduras was its main target in the region, with some pages focused on Mexico.

Put the pieces together and the risk for 2027 has two sides. One is someone getting into the phone of an election official or a journalist. The other is using what they find, or what they invent, in a fake-profile campaign targeted with the same precision. Team Jorge already showed both can be sold as a single service.

Why Mexico is a target

The report does not explain why Mexico appears. What follows is my reading, based on public facts.

Mexico has taken a side on Palestine. In May 2024, Mexico asked to intervene in South Africa’s genocide case against Israel at the International Court of Justice. President Claudia Sheinbaum has said her government opposes the genocide in Gaza and recognizes Palestine as a state, and in May 2026 she condemned Israel’s aggression against the Global Sumud Flotilla, which carried Mexican citizens. Outside government, Mexico’s anti-Zionist movement is broad and visible, in the streets, on campuses and in organizations. A country with that stance, along with its diplomats and its activists, is a logical target for an Israeli intelligence industry.

Mexico has been a spyware market before. The report itself recalls it: Citizen Lab’s first Pegasus findings were in Mexico, almost ten years ago. In 2022, Citizen Lab and R3D confirmed through forensic analysis that journalist Ricardo Raphael, a journalist at Animal Político and human rights defender Raymundo Ramos were infected with Pegasus between 2019 and 2021. Leaked internal documents later tied that spying to a unit of the Mexican Army. Spyware sellers know Mexico has had buyers.

An election year is coming. Mexico holds midterm elections in June 2027, and a Mexican election authority has already received ads from this operation.

The legal framework is thin. Mexico has no federal cybersecurity law. Bills have sat in the Senate since April 2025 without passing. The closest thing is the General Cybersecurity Policy for the Federal Public Administration, published December 17, 2025, which binds only federal agencies. Personal data protection moved from the INAI, dissolved in 2025, to the Secretariat of Anti-Corruption and Good Government.

Who could be a target

Based on the report’s pattern and Mexico’s recent history, the risk is highest for:

• Activists and organizations that stand with Palestine and denounce the genocide in Gaza, including the Mexicans who have sailed with the flotillas.
• Journalists and news organizations. The confirmed target of this operation is Al Jazeera, and the report urges newsrooms to review their security and their logs.
• Foreign ministry and diplomatic staff. One infection link pointed to a network of Saudi Arabia’s Ministry of Foreign Affairs.
• Election authorities and campaign teams, heading into 2027.
• Human rights defenders and opposition politicians, who in Mexico have already been targeted with Pegasus.
• Officials with access to sensitive information on security, defense, energy or trade negotiations.
• Critical infrastructure staff. The report records ads on the network of Westinghouse, the US nuclear company.

What to do starting today

Citizen Lab is blunt: there is currently no consistently safe way to expose your users and networks to targeted ads. The most effective step is to block them. These recommendations come from the report, except where I say otherwise.

If your work could make you a target

1. Block ads on every device. Use a trusted ad-blocking extension and a browser that limits tracking. At home, a network-level blocking service also protects your family’s devices.
2. Delete or reset your advertising ID regularly. On Android: Settings, Google, Ads, Delete advertising ID. On iPhone: Settings, Privacy & Security, Tracking, and turn off “Allow Apps to Request to Track.”
3. Turn off ad personalization in every app that allows it.
4. Remove free, ad-supported apps and games from your work phone. The report publishes no list of dangerous sites or apps, because the code arrives through the ad slot, and ad slots appear in thousands of ordinary sites and apps. The practical rule is fewer ads on the device that holds your sensitive information.
5. If you use an iPhone and your risk is high, turn on Lockdown Mode in Settings, Privacy & Security. This is not from the report; it is an Apple feature designed for people who may be targeted by spyware.

If you run an agency, a newsroom, an election authority or an organization

1. Require ad blocking on every institutional device and disable advertising IDs through mobile device management (MDM).
2. Block ads and tracking at your network gateway, not only on each device.
3. Check your network logs for the domains Citizen Lab published in Appendix C of the report, including controlium[.]net, powerium[.]net, mtrtb[.]com and cookie-sync[.]xyz. If they show up, treat it as an incident.
4. Check which ads your own website loads. A government or news site that shows third-party ads exposes its own readers to this same channel. A public agency’s pages should not load programmatic advertising.

If you make policy

Several of these steps don’t need to wait for a law.

1. Use the General Cybersecurity Policy. The ATDT can issue guidelines requiring federal agencies to block ads and disable advertising IDs on their devices. That is exactly what Citizen Lab recommends to governments.
2. Review election authorities’ logs now, before the 2027 process, and make public anything they find.
3. Bar every agency from contracting spyware or manipulation firms named by Citizen Lab, Forbidden Stories or the US blacklist, and check whether any agency has current contracts with them or their intermediaries.
4. Demand accountability through diplomatic channels. The foreign ministry can formally ask the state of Israel for information on these companies’ export licenses and their activity in Mexico, and renew the extradition request for Tomás Zerón.
5. Ask the platforms for information. Google, Microsoft (Xandr), Beeswax, Liftoff and Eskimi served Discover-Tech ads. Congress and regulators can ask what traffic was shown to users in Mexico and which networks it reached.
6. Agree on fast reporting channels with Meta, Google, X and TikTok for 2027, with an obligation to report publicly when they remove fake-profile networks aimed at Mexico.
7. Pass a cybersecurity law with real oversight. Citizen Lab calls on lawmakers for frameworks with mandatory oversight and clear penalties. It also calls for removing personal data from real-time ad auctions, the system that made this attack possible.
8. Make surveillance purchases transparent. Knowing what the state buys, and under what judicial control, is the basis for making sure this does not repeat with a new technology.

The investigation is still open

Citizen Lab announced a further report on another actor that uses Discover-Tech’s infrastructure to link advertising IDs to phone numbers. I’ll update this article when it comes out.

Mexico already paid the price of not acting on Pegasus: journalists spied on, and a man responsible still out of reach of Mexican justice. This time there is time to act before the elections.

The full Citizen Lab report is worth having your security team read in full this week if you work at an institution that could be a target.

Get new pieces when they land

No schedule and no newsletter template. A short note when there is something worth reading, and nothing else. The list is not shared.

Leave this empty Sign up