An Israeli digital advertising agency, Discover-Tech, used a large network of online advertisements to monitor internet users, follow targets and help hack their devices, two research groups said on Thursday. In separate reports, Citizen Lab, a Canadian cyber watchdog, and Confiant, a New York advertising security firm, said the company’s services gave Candiru and other Israeli surveillance firms access to ad platforms run by Google, Comcast, Russia’s Yandex and others. Candiru is a spyware company that the US government has blacklisted.
The findings suggest that online advertising, long criticised over privacy concerns, can also be turned into a channel for large-scale espionage. Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters that the way online advertising works today poses a systemic security threat to governments, companies, civil society and ordinary people alike.
How Discover-Tech ads tracked users and planted spyware
Discover-Tech’s ads often promoted everyday products such as phones and earpods. Through its various partnerships, they reached more than 120,000 websites and 75,000 apps, Citizen Lab said. People who visited those sites or used those apps could be identified and tracked, and the firm sometimes tried to extract phone numbers from some smartphone users, the researchers said.
Notably, an ad did not need to be clicked for the surveillance to take place; it only needed to load on a website. Some of the ads were used to help install Candiru spyware on users’ devices, both research groups said. Confiant, however, said the ads it linked to Candiru made up only a tiny fraction of Discover-Tech’s overall volume.
Confiant cofounder Jerome Dangu said Discover-Tech was pushing out at least 10 million ads a day around the world. He said data-sharing arrangements known as cookie matching allowed the firm to track people even beyond the reach of its own advertisements. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Ads reached sensitive institutions and devices
Dangu said the malicious ads had appeared on hundreds of networks in sensitive categories, including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He also said parts of the Palestinian territories were especially saturated by the Israeli firm’s ads, and that nearly any website visited there would display one, giving the company broad insight into the online activity of an entire population.
Citizen Lab said it had similar evidence that the malicious ads were shown to people at the United Nations, NATO, the European Commission and more than a dozen other national governments. Other networks carrying the ads included chip-related companies such as Nvidia, Sandisk, Broadcom and Micron, as well as several media organisations in Mexico, Israel and Europe that were not identified.
Citizen Lab also said a powerful form of Candiru spyware delivered through Discover-Tech’s ads had been used to compromise 45 Windows devices at the Qatari broadcaster between 2024 and 2025. The group said it could confirm this because the media network had shared its network logs with it. did not respond to messages seeking comment.
Platforms cut ties with Discover-Tech after findings
Discover-Tech did not respond to messages left through its contact form. A LinkedIn message and emails sent to its chief executive, Dekel Boni, also went unanswered, and Reuters was unable to reach Candiru’s owners. The firm was founded in 2020. The US Commerce Department blacklisted Candiru in 2021, alleging that it supplied spyware used to maliciously target government officials, journalists, activists and academics.
Citizen Lab further said Discover-Tech had inadvertently exposed its authentication logs to the internet. These logs showed people logging in from internet protocol addresses in Israel, Europe and the Gulf, which offered some clues about where the firm’s users might be based.
Platforms have started to act. Google said it worked with Citizen Lab and Confiant on the investigation and removed Discover-Tech from its ad platforms “for systematically violating our policies.” IAB Europe, the European association for the digital marketing and advertising sector, said in an email that Discover-Tech had been suspended from its list of globally approved vendors the previous week after an audit identified policy violations. Comcast’s ad technology subsidiary Beeswax removed the firm “following recent activity,” Comcast said in a statement. Yandex did not return Reuters’ messages seeking comment.
The issue is increasingly viewed as a national security threat. Earlier this year, the Pentagon said it had received reports that US forces deployed to war zones had been targeted using location data collected by ad technology firms and data brokers. Branches of the military have since disabled ad tracking on some devices.
