Spy Ads Reached Norway’s Parliament. Europe’s Defense Begins in Its Own Backyard

Online advertisements bought by Discover-Tech, an Israeli surveillance company, appeared on devices using networks associated with Stortinget, Norway’s parliament. The company’s ads also reached networks used by Kripos, Norway’s national criminal investigation service, and Nkom, its communications regulator. Citizen Lab, a research group at the University of Toronto, published the findings on Oct. 15, 2026.

The Norwegian findings establish advertisement exposure; determining whether individual devices were infected requires forensic investigation. The wider mapping reaches across institutions central to European security: municipal networks near military installations in northern Norway, Sweden’s Armed Forces and weapons manufacturer Saab, and Denmark’s railway operator Banedanmark and energy company Ørsted.

Together, these findings bring a civilian vulnerability into Europe’s military buildup. The institutions preparing societies for a crisis operate inside a commercial data economy that also gives surveillance businesses access to their audiences.

At Al Jazeera, the advertisement led to spyware

At international broadcaster Al Jazeera, researchers documented what happened after devices encountered the advertising infrastructure. During attacks in 2024 and 2025, devices first contacted Discover-Tech’s advertising systems, then servers that examined them, and finally the control infrastructure of Candiru spyware. An advertisement had become the opening stage of an infection.

The advertisement itself could also collect information. Across more than 1,000 website domains, advertising security company Confiant found code gathering browser data that sometimes included identifiers associated with active logins, email addresses and full names. For investigators examining the Norwegian exposure, establishing what the advertisements collected is therefore part of the inquiry alongside the search for infected devices.

Norway stood out in Confiant’s measurements. Between April 1 and Sept. 10, Discover-Tech accounted for 1.3 percent of observed iOS advertisement impressions in Norway within the company’s sample. In activity associated with Candiru, most observed advertisements reached residential broadband or mobile connections, taking the investigation into the digital lives people carry beyond their workplaces.

Citizen Lab also described an operation called DARK CARTOGRAPHER, which sought to connect advertising identifiers with mobile phone numbers. Researchers found exploitation of weaknesses affecting mobile providers in more than 30 countries. Establishing whether Norwegian operators were affected gives Nkom a specific question to pursue.

The car outside is part of the defense system

Total defense organizes the armed forces, civilian authorities, businesses and the population around national preparedness. A military deployment depends on electricity, transport, communications and healthcare. The people keeping those services running move between critical workplaces and homes surrounded by connected devices.

Consider the vehicle parked outside a military installation, a power company or a government office. A modern connected car can carry cameras, microphones, satellite navigation and an internet connection. Its ability to record and transmit information depends on the model and its services, making those details part of the security assessment: what does the vehicle collect, where does the information travel, and who can retrieve it?

The same scrutiny belongs inside the building. A copier or printer can retain scanned documents and print jobs, while a phone accompanies its owner through meetings, journeys and private life. A car key adds a radio interface with its own security requirements. Each device creates a different set of questions about storage, wireless access, software and data sharing.

Google’s glasses make cameras and microphones conspicuous. Millions of other devices collect smaller fragments of daily life more quietly. Repeated location records can reveal a routine, while identifiers can connect observations across services. For personnel working in defense and critical infrastructure, those fragments may expose movements and relationships valuable to an adversary.

The procurement question reaches beyond ownership of the equipment. It includes control of the information generated whenever that equipment is used.

The warning trail begins in August

Advertising platform Eskimi says it stopped its last Discover-Tech campaign on Aug. 6. In a letter dated Oct. 14, the company explained that the advertisements delivered different code according to a recipient’s device, IP address and location. That selective delivery helped the campaigns evade automated security checks.

Eskimi says it shared technical indicators with supply partners and holds further information about the targeting. This creates a warning trail investigators can reconstruct: when the indicators were distributed, which companies received them and what action followed. Those records could help establish how quickly the advertising supply chain responded.

On Oct. 15, advertising industry organization IAB Europe confirmed Discover-Tech’s suspension from its vendor list following policy violations. Discover-Tech’s website continued to display a registration badge. Its privacy policy, marked updated Oct. 9, described storage of IP addresses and advertising identifiers on Amazon Web Services infrastructure in the United States, with retention reaching 365 days for some profiling purposes.

Those records identify concrete places to investigate: campaign targeting, distribution partners, stored identifiers and retention periods. The identity of the governments commissioning the documented spyware attacks remains an open question.

Norway recognized the data problem six years ago

On Jan. 14, 2020, the Norwegian Consumer Council published an investigation into personal information flowing from applications into the advertising industry. Norwegian security company Mnemonic conducted the technical testing. Researcher Wolfie Christl, a co-author of the new Citizen Lab investigation, helped analyze the advertising market.

Six years later, the question is how that knowledge changed the equipment public institutions bought and the protection offered to their employees. Procurement records and security policies can supply concrete answers. A vehicle contract should establish access to cameras and microphones; a printer contract should specify document retention; a phone policy should address applications and advertising identifiers alongside passwords and encryption.

These decisions reach directly into military readiness. A missile battery depends on crews, communications, maintenance and supplies. Drones depend on operators and reliable information. The people sustaining those capabilities return home with their phones, connect to residential broadband and travel in vehicles whose data arrangements may have been settled far from a defense ministry.

An adversary seeking to understand that force has reason to follow the people around it. Every contract governing their connected equipment therefore carries a defense question: who else gets to see what happens inside Europe’s own backyard?