An Israeli digital advertising agency used a sprawling network of online ads to track internet users and help plant spyware on their devices, according to two research groups.
Discover-Tech’s services gave Israel’s Candiru, a spyware company blacklisted by the U.S. government, and other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia’s Yandex and others, according to separate reports released Thursday by the Canadian cyber watchdog group Citizen Lab and New York advertising security firm Confiant.
The reports show how the online advertising business, long a subject of privacy concerns, can also serve as a channel for sweeping espionage campaigns.
“The way online advertising works today is a systemic security threat,” said Wolfie Cristl, a senior researcher at Citizen Lab. “For states, the private sector, civil society and everyone else alike.”
Discover-Tech’s online ads — often for ordinary products such as phones or earbuds — reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen Lab said.
Users who visited sites or used apps containing the malicious ads could be identified and tracked by Discover-Tech, which would sometimes also try to extract phone numbers from some smartphone users, the researchers said. Ads only needed to load on a website for the spying to occur.
Some ads were used to help plant spyware from Candiru on users’ devices, both research groups said, though Confiant said the ads it tied to Candiru represented a tiny fraction of Discover-Tech’s overall volume.
Malicious ads appeared in hundreds of sensitive networks
Confiant cofounder Jerome Dangu said Discover-Tech was pumping out at least 10 million ads per day worldwide and that data-sharing arrangements — called cookie matching — allowed it to track people even beyond the reach of its advertisements.
“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Discover-Tech, founded in 2020, did not return messages left via its contact form. A LinkedIn message and emails sent to its chief executive, Dekel Boni, were not returned.
Reuters’ attempts to reach Candiru’s owners were unsuccessful. The U.S. Commerce Department blacklisted Candiru in 2021 for allegedly supplying spyware used to maliciously target government officials, journalists, activists and academics.
Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech’s ads had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025. Citizen Lab said it was able to confirm the compromise because the media group had shared its network logs with the organization. Al Jazeera did not return messages seeking comment.
Dangu of Confiant said the malicious ads had been shown to users in “hundreds of networks in sensitive categories,” including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He also said some regions, such as the Palestinian territories, were particularly saturated by the Israeli firm’s ads.
“You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,” he said.
Citizen Lab also said it had similar evidence showing the malicious ads were shown to people in the United Nations, NATO, the European Commission and more than a dozen other national governments. Other networks where the ads appeared included chip-related firms such as Nvidia, Sandisk, Broadcom and Micron, as well as several media organizations in Mexico, Israel and Europe that were not identified.
In addition to identifying Candiru and other surveillance vendors, Citizen Lab said it was able to glean some details about where Discover-Tech’s users might be based because the firm inadvertently exposed its authentication logs to the internet, showing people logging in from internet protocol addresses in Israel, Europe and the Gulf.
Measures taken against Discover-Tech
Discover-Tech is now being frozen out of parts of the online ad market.
Google said in a statement that it had collaborated with the Citizen Lab and Confiant investigation and removed Discover-Tech from its ad platforms “for systematically violating our policies.”
IAB Europe, the European-level association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had been suspended from its list of globally approved vendors last week after an audit identified policy violations.
Comcast ad tech subsidiary Beeswax removed Discover-Tech from its platform “following recent activity,” Comcast said in a statement. Yandex did not return Reuters messages seeking comment.
Advertising-driven surveillance is increasingly being seen as a national security threat. Earlier this year, the Pentagon said it had received reports that U.S. forces deployed to war zones had been targeted using location data harvested by ad tech firms and data brokers. Branches of the military have since disabled ad tracking on some devices.
