WASHINGTON: Israeli digital advertising firm Discover-Tech used a vast network of online advertisements to track internet users and help install spyware on targeted devices, according to research published on Thursday by two cybersecurity groups.
The reports, released separately by Canadian research organisation Citizen Lab and New York-based advertising security firm Confiant, said Discover-Tech gave Israeli surveillance companies, including spyware maker Candiru, access to advertising platforms operated by Google, Comcast, Russia’s Yandex and other companies.
The findings highlight how online advertising, long criticised over privacy concerns, can also become a channel for large-scale surveillance and espionage.
“The way online advertising works today is a systemic security threat,” Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters.
Ads Reached More Than 120,000 Websites
Citizen Lab said Discover-Tech’s advertisements appeared across more than 120,000 websites and 75,000 apps through its partnerships. Many promoted ordinary consumer products, including phones and wireless earbuds.
According to the researchers, users could be identified and tracked when the ads loaded on websites or within apps. Discover-Tech also allegedly attempted to extract phone numbers from some smartphone users.
Both research groups said certain advertisements helped deliver Candiru spyware to targeted devices. Confiant, however, said ads linked to Candiru represented only a small fraction of Discover-Tech’s overall advertising volume.
Jerome Dangu, Confiant’s co-founder, said Discover-Tech distributed at least 10 million advertisements worldwide each day. Data-sharing arrangements known as cookie matching could allow the firm to track users beyond the websites displaying its ads.
“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Researchers Identify Sensitive Targets
Citizen Lab said it found evidence that a powerful Candiru spyware tool, delivered through Discover-Tech advertisements, compromised 45 Windows devices at Qatari broadcaster Al Jazeera between 2024 and 2025.
The researchers said they confirmed the activity after Al Jazeera shared its network logs with them. The broadcaster did not respond to requests for comment.
Dangu said malicious advertisements appeared across hundreds of networks in sensitive categories, including those associated with the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
He also said Discover-Tech advertisements were particularly widespread in the Palestinian territories, potentially giving the company extensive visibility into online activity across the region.
Citizen Lab reported similar evidence of advertisements appearing on networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments.
The ads also appeared on networks linked to semiconductor companies, including Nvidia, SanDisk, Broadcom and Micron. Researchers additionally identified several media organisations in Mexico, Israel and Europe, but did not name them.
Candiru Previously Blacklisted by US
Citizen Lab said it identified Candiru and other surveillance technology providers through its investigation. The group also found that Discover-Tech had inadvertently exposed authentication logs online, revealing login activity from internet protocol addresses in Israel, Europe and the Gulf.
Founded in 2020, Discover-Tech did not respond to messages sent through its contact form or to emails and a LinkedIn message addressed to its chief executive, Dekel Boni.
Reuters also said it was unable to reach Candiru’s owners for comment.
The US Commerce Department blacklisted Candiru in 2021 over allegations that it supplied spyware used to target government officials, journalists, activists and academics.
Google and Other Platforms Take Action
Discover-Tech has begun losing access to parts of the online advertising market following the findings.
Google said it had worked with Citizen Lab and Confiant during the investigation. The company subsequently removed Discover-Tech from its advertising platforms for what it described as systematic violations of its policies.
IAB Europe, an association representing the digital marketing and advertising industry, said it suspended Discover-Tech from its list of globally approved vendors the previous week after an audit identified policy violations.
Comcast said its advertising technology subsidiary, Beeswax, had removed Discover-Tech from its platform following recent activity. Yandex did not respond to Reuters’ request for comment.
Advertising Surveillance Raises Security Concerns
The findings come amid growing concern that advertising technology and commercial data collection can expose sensitive information to governments and other actors.
Earlier this year, the Pentagon said it had received reports that US military personnel deployed in conflict zones were being targeted using location data collected by advertising technology companies and data brokers.
Several branches of the US military have since disabled advertising trackers on some devices, Reuters reported.
The latest investigation adds to concerns that data collected through routine online advertising can be repurposed for surveillance, targeted cyberattacks and potential national security threats.
