Spyware-linked ads from Israeli advertising firm Discover-Tech were displayed on devices using the Norwegian Parliament (Stortinget) network, according to research published on 15 October. The findings do not establish that parliamentary devices were infected with spyware.
Norwegian news agency NTB reported on 16 October, citing Dagens Næringsliv, that the findings also cover the National Criminal Investigation Service (Kripos), the Norwegian Communications Authority (Nasjonal kommunikasjonsmyndighet) and the Norwegian Digitalisation Agency (Digitaliseringsdirektoratet). The report also identifies county and municipal networks in northern Norway.
What the spyware-linked ads do and do not prove
Citizen Lab’s investigation distinguishes exposure to advertisements from a confirmed spyware infection. Its researchers caution:
A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.
They assess that the observed advertisements would, at minimum, have enabled profiling. Establishing whether particular devices were infected requires further investigation.
The research also identifies ad impressions on networks associated with Sweden’s armed forces, Danish infrastructure operators, the European Parliament and European Commission. These observations establish exposure to advertising infrastructure, rather than confirmed infections.
How online advertising becomes a surveillance tool
In its parallel technical investigation, advertising-security company Confiant describes a system that combines apparently ordinary advertisements with code collecting information about devices and their users.
Its analysis covers activity between 1 April and 10 September 2026. Confiant estimates that Discover-Tech served roughly 10 million ad impressions a day, gathering identifiers, IP addresses and device characteristics to build profiles. This information could help single out devices for additional code delivery.
The process does not require a click. Code can run when the ad loads inside a website or app. That makes it different from a phishing message asking someone to open a link.
Citizen Lab calls spyware infection through targeted advertisements AdFection. It confirmed that Candiru spyware infected devices at Al Jazeera through this delivery method. That finding is separate from the evidence of advertisements appearing on Norwegian institutional networks.
Advertising bodies have begun restricting Discover-Tech
IAB Europe said on 15 October that Discover-Tech had been suspended from the Global Vendor List of its Transparency and Consent Framework following an audit that found policy violations. The industry association said further confirmation of the researchers’ findings could justify permanent expulsion.
Citizen Lab says Google also terminated Discover-Tech’s access to its advertising exchanges. Reuters reported that Discover-Tech and Candiru had not responded to its attempts to obtain comment.
The findings add a security dimension to Norway’s wider debate over advertising technology. NordiskPost recently covered Norway’s enforcement action over Grindr data sharing, a separate case concerning personal information circulated through advertising auctions.
