An Israeli digital advertising agency used a sprawling network of online ads to track internet users and help hack their devices, according to two research groups that published separate reports on Thursday.
The reports, by the Canadian cyber watchdog Citizen Lab and the New York advertising security firm Confiant, say the agency, Discover-Tech, gave Candiru, an Israeli spyware company blacklisted by the US government, and other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia’s Yandex and others. Reuters first reported the findings.
How the ads worked
Citizen Lab said Discover-Tech’s ads, often for ordinary products such as phones or earpods, reached more than 120,000 websites and 75,000 apps through its partnerships. Visitors to those sites, or users of those apps, could be identified and tracked by the firm, which sometimes also tried to extract phone numbers from smartphone users. The ads only needed to load on a page for the spying to take place.
Some of the ads were used to help plant Candiru spyware on devices, both groups said, although Confiant said the ads it linked to Candiru were a tiny fraction of Discover-Tech’s overall volume. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” said Confiant’s Dangu.
“The way online advertising works today is a systemic security threat,” Citizen Lab senior researcher Wolfie Cristl told Reuters. “For states, the private sector, civil society and everyone else alike.”
Al Jazeera devices compromised
Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech’s ads was used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025. It said it could confirm this because the media group shared its network logs. Al Jazeera did not return messages seeking comment.
Confiant said the malicious ads had been shown to users in “hundreds of networks in sensitive categories”, including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab said it had similar evidence of the ads being shown to people at the United Nations, NATO, the European Commission and more than a dozen national governments. Chip-related companies such as Nvidia, SanDisk, Broadcom and Micron were also among the networks reached, along with several media organisations in Mexico, Israel and Europe that were not named.
Palestinian territories heavily targeted
Dangu said some regions were especially saturated by the Israeli firm’s ads, naming the Palestinian territories. “You go to almost any site in Palestine, any site, you find a Discover-Tech ad,” he said. “It gives them a very complete visibility on the digital activities of an entire country.”
Citizen Lab also said Discover-Tech inadvertently exposed its authentication logs to the internet, which showed people logging in from internet protocol addresses in Israel, Europe and the Gulf.
The industry reacts
Discover-Tech, founded in 2020, did not return messages left through its contact form, a LinkedIn message or emails to its chief executive, Dekel Boni. Reuters’ attempts to reach Candiru’s owners were not successful. The US Commerce Department blacklisted Candiru in 2021 for allegedly supplying spyware used to target government officials, journalists, activists and academics.
The company is now being shut out of parts of the ad market:
- Google said it had worked with the Citizen Lab and Confiant investigation and removed Discover-Tech from its ad platforms “for systematically violating our policies”.
- IAB Europe, the European association for the digital marketing industry, said Discover-Tech was suspended from its list of globally approved vendors last week after an audit found policy violations.
- Comcast’s ad technology subsidiary Beeswax removed the firm from its platform “following recent activity”, Comcast said.
- Yandex did not respond to Reuters.
Why it matters
The reports show how a routine part of the web, the advertising that pays for most free sites and apps, can double as a tool for state-level surveillance. Researchers say a user does not need to click on anything for tracking to begin. Advertising-driven surveillance is increasingly treated as a national security risk: earlier this year the Pentagon said it had received reports that US forces in war zones had been targeted using location data collected by ad technology firms and data brokers, and some military branches have since disabled ad tracking on certain devices.
Read our related reports on Anthropic’s warning that rogue AI could spread like a botnet and on the FBI arrest of an OpenAI engineer.
This article draws on reporting by Reuters and The Express Tribune.
Comments
Comments are reviewed by our editors before they appear. Please keep them civil and on topic. See our terms.
No comments yet. Be the first to share your view.