Israeli digital advertising agency Discover-Tech ran a large network of online ads that spied on internet users, according to two research groups. The ads were used to track selected targets and to help hack their devices, the groups said.
Discover-Tech’s services gave Candiru, an Israeli spyware company that the US government has blacklisted, and other Israeli surveillance firms access to ad platforms run by Google, Comcast, Russia’s Yandex and others. The findings come from separate reports by Citizen Lab, a Canadian cyber watchdog group, and Confiant, a New York advertising security firm.
The reports suggest that online advertising, which has long drawn privacy concerns, can also be used as a channel for large-scale espionage campaigns.
How the malicious ads reached internet users
Discover-Tech’s ads were often for everyday products such as phones and earbuds. Through its partnerships, they appeared on more than 120,000 websites and 75,000 apps, Citizen Lab said.
Users who visited those sites or used those apps could be identified and tracked by Discover-Tech, the researchers said. The firm sometimes tried to extract phone numbers from some smartphone users. The spying did not require any click, because an ad only needed to load on a page for it to take effect.
Some of the ads were used to help plant Candiru spyware on users’ devices, both groups said. Confiant said the ads it tied to Candiru made up only a tiny fraction of Discover-Tech’s overall volume.
Confiant cofounder Jerome Dangu said Discover-Tech was distributing at least 10 million ads per day worldwide. He added that cookie matching, a data-sharing arrangement, allowed the company to track people even beyond the places its ads appeared.
“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
staff and sensitive organisations affected
Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech’s ads had been used to compromise 45 Windows devices at the Qatari broadcaster between 2024 and 2025. The group said it could confirm this because the media organisation had shared its network logs with it.
In a statement, said it “condemns the spyware attacks targeting a number of its staff” and that it was taking steps to protect its employees and systems. “Those responsible must be held accountable,” it said.
Dangu said the malicious ads had been shown to users across hundreds of networks in sensitive categories. He named the Pentagon, the International Atomic Energy Agency and the International Criminal Court among them. He also said the Palestinian territories were especially saturated with the firm’s ads.
“You go to almost any site in Palestine — any site — you find a Discover-Tech ad,” he said. “It gives them a very complete visibility on the digital activities of an entire country.”
Citizen Lab said it had similar evidence that the malicious ads were shown to people working at the United Nations, NATO, the European Commission and more than a dozen national governments. The ads also appeared on networks run by chip-related firms, including Nvidia, Sandisk, Broadcom and Micron, as well as several media organisations in Mexico, Israel and Europe that were not identified.
Ad firm cut off by platforms amid security concerns
Beyond identifying Candiru and a few other surveillance vendors, Citizen Lab said it learned where some Discover-Tech users might be based. The firm had inadvertently exposed its authentication logs to the internet, which showed people logging in from internet protocol addresses in Israel, Europe and the Gulf.
Discover-Tech is now being shut out of parts of the online advertising market. Google said it had worked with Citizen Lab and Confiant on the investigation and removed the company from its ad platforms “for systematically violating our policies.”
IAB Europe, the European association for the digital marketing and advertising sector, said in an email that Discover-Tech had been suspended from its list of globally approved vendors the previous week after an audit identified policy violations. Comcast’s ad technology subsidiary Beeswax removed the firm from its platform “following recent activity,” Comcast said in a statement.
Discover-Tech, which was founded in 2020, did not respond to messages left through its contact form. A LinkedIn message and emails sent to its chief executive, Dekel Boni, also went unanswered. Attempts to reach Candiru’s owners were unsuccessful, and Yandex did not respond to requests for comment.
The US Commerce Department blacklisted Candiru in 2021, alleging that it supplied spyware that was used to maliciously target government officials, journalists, activists and academics.
Advertising-driven surveillance is increasingly being treated as a national security risk. Earlier this year, the Pentagon said it had received reports that US forces deployed to war zones were targeted using location data collected by ad technology firms and data brokers. Some branches of the military have since disabled ad tracking on some devices.
