Israeli firm used online ads to run vast spy operation: researchers

Online Advertising Network Linked to Large-Scale Digital Surveillance

Bdbusinessdaily.com – An Israeli digital advertising agency is accused of using ordinary online advertisements as a far-reaching surveillance tool, enabling the tracking of internet users and, in some cases, supporting attempts to compromise their devices with spyware.

Research by Citizen Lab in Canada and advertising-security company Confiant identified Discover-Tech as a key participant in the operation. The firm’s advertising infrastructure was connected to major ad platforms operated by companies including Google, Comcast and Russia’s Yandex, giving its campaigns exceptionally broad reach across websites and mobile applications.

The findings underline a serious risk within the modern advertising ecosystem: ads are not simply promotional material. Because they routinely collect technical and behavioral data to target audiences, they can also become an effective channel for surveillance when used maliciously.

The way online advertising works today is a systemic security threat,

said Wolfie Christl, a senior researcher at Citizen Lab. He said the danger affects governments, businesses, civil society groups and individual users alike.

Ads Reached Tens of Thousands of Digital Platforms

Discover-Tech, founded in 2020, distributed advertisements that often appeared to promote everyday consumer products such as smartphones and earbuds. Citizen Lab found that the company’s partnerships allowed those ads to appear on more than 120,000 websites and 75,000 apps.

Just loading an affected advertisement could allow Discover-Tech to identify and follow users, researchers said. In certain cases, the system also attempted to obtain phone numbers from smartphone users. This meant a person did not necessarily have to click an ad, install software or knowingly engage with a suspicious page before information could be collected.

Confiant estimated that Discover-Tech was delivering at least 10 million ads every day across the world. Cookie-matching arrangements, which let advertising companies connect user data across different services, may have extended the company’s visibility beyond the sites where its own ads appeared.

Very likely hundreds of millions of people would have been touched by Discover-Tech,

said Confiant co-founder Jerome Dangu.

Most of the advertising volume was not directly tied to malware delivery. However, both research groups identified advertisements that were used in efforts to deploy spyware made by Candiru, an Israeli surveillance company. Confiant said the ads connected with Candiru represented only a very small portion of Discover-Tech’s total activity.

Candiru Spyware and Sensitive Targets

Candiru was placed on a US Commerce Department blacklist in 2021 over allegations that its spyware had been supplied for malicious targeting of government personnel, journalists, activists and academics. Its tools are designed to gain deep access to devices, making them especially dangerous when used against people handling sensitive information.

Citizen Lab said a sophisticated Candiru tool delivered through Discover-Tech advertising had compromised 45 Windows devices at Al Jazeera between 2024 and 2025. The group said it verified the incidents after the Qatari broadcaster provided network logs for examination.

Al Jazeera condemned the attacks against members of its staff and said it was taking action to safeguard employees and its systems.

Those responsible must be held accountable,

the broadcaster said.

The ad campaigns also appeared within numerous organizations and networks considered highly sensitive. Dangu said Discover-Tech advertisements had been seen in hundreds of such environments, including the Pentagon, the International Atomic Energy Agency and the International Criminal Court.

Citizen Lab found similar indications involving users connected to the United Nations, NATO, the European Commission and more than a dozen national governments. The advertisements were also observed in networks associated with semiconductor businesses, including Nvidia, Sandisk, Broadcom and Micron, as well as unnamed media organizations in Mexico, Israel and Europe.

Palestinian Territories Identified as Heavily Exposed

Some geographic areas appeared to be exposed far more heavily than others. Dangu said the Palestinian territories were among the places where Discover-Tech advertisements were particularly widespread.

You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,

he said.

That level of exposure illustrates why advertising technology can create privacy and security concerns beyond conventional marketing. Ad networks frequently use device identifiers, browsing patterns, location-related signals and other information to decide which promotions to show. When these systems are abused, the same tools can offer a detailed picture of users’ online behavior at an immense scale.

Citizen Lab also found indications of Discover-Tech user activity through authentication logs that had been inadvertently exposed online. Those records showed logins from internet protocol addresses in Israel, Europe and Gulf countries.

Advertising Market Begins Restricting the Firm

Discover-Tech did not respond to messages sent through its contact form. Its chief executive, Dekel Boni, also did not reply to messages sent through LinkedIn or email. Attempts to contact Candiru’s owners were unsuccessful as well.

Parts of the online advertising market have begun cutting off Discover-Tech. Google said it worked with Citizen Lab and Confiant during the investigation and removed Discover-Tech from its advertising platform.

The case demonstrates how the scale and automated nature of digital advertising can amplify cybersecurity threats. An ad that appears harmless on a news site, shopping page or mobile app may be delivered through a chain of intermediaries that users cannot see or assess. For readers, organizations and platform operators, the episode is a reminder that online advertising is not merely a commercial system: it can also create an entry point for tracking, profiling and targeted digital intrusion.