Israeli ad firm turned online advertising into a pipeline for spyware, researchers say
Discover-Tech’s ads reached more than 120,000 websites and 75,000 apps, according to Citizen Lab. Researchers say the company helped Israeli surveillance firms track users and deliver spyware, prompting Google and other advertising platforms to cut ties with it.
Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads that it used to track targets and help hack their devices, two research groups said on Thursday.
The agency’s services gave Israeli spyware company Candiru, which has been blacklisted by the U.S. government, and other Israeli surveillance firms access to advertising platforms operated by Google, Comcast, Russia’s Yandex and others, according to separate reports by Citizen Lab, a Canadian cybersecurity research group, and Confiant, a New York-based advertising security firm.
The reports show how the online advertising industry, long the subject of privacy concerns, can also serve as a channel for sweeping espionage campaigns.
“The way online advertising works today is a systemic security threat,” Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters. “For states, the private sector, civil society and everyone else alike.”
Discover-Tech’s ads, often promoting ordinary products such as phones or earbuds, reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen Lab said.
Users who visited websites or used apps carrying the ads could be identified and tracked by Discover-Tech, the researchers said. The company would sometimes also attempt to extract phone numbers from smartphone users. In some cases, the ads only needed to load on a website for the surveillance to take place.
Some of the ads were used to help install Candiru spyware on users’ devices, both research groups said. Confiant noted, however, that the ads it linked to Candiru accounted for only a tiny fraction of Discover-Tech’s overall advertising volume.
Confiant co-founder Jerome Dangu said Discover-Tech was serving at least 10 million ads a day worldwide. Data-sharing arrangements known as cookie matching also allowed the company to track people beyond the reach of its own advertisements.
“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Founded in 2020, Discover-Tech did not respond to messages left through its contact form. A LinkedIn message and emails sent to its CEO, Dekel Boni, also went unanswered.
Reuters was unable to reach Candiru’s owners for comment. The U.S. Commerce Department blacklisted Candiru in 2021 over allegations that it supplied spyware used to maliciously target government officials, journalists, activists and academics.
Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech’s ads had been used to compromise 45 Windows devices at Qatari broadcaster Al Jazeera between 2024 and 2025. The group said it was able to confirm the breaches because Al Jazeera had shared its network logs with researchers. Al Jazeera did not respond to requests for comment.
Dangu said malicious ads had been displayed to users across “hundreds of networks in sensitive categories,” including those associated with the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He also said some regions, including the Palestinian territories, were particularly saturated with Discover-Tech ads.
“You go to almost any site in Palestine, any site, you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,” he said.
Citizen Lab said it had found similar evidence that the ads were shown to people using networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments.
The ads also appeared on networks associated with semiconductor companies, including Nvidia, SanDisk, Broadcom and Micron, as well as several unidentified media organizations in Mexico, Israel and Europe, the researchers said.
Citizen Lab also uncovered information that could help establish where Discover-Tech’s users were based. The company had inadvertently exposed its authentication logs to the internet, revealing logins from IP addresses in Israel, Europe and the Gulf, the group said.
Discover-Tech is now being excluded from parts of the online advertising market.
Google said it had collaborated with Citizen Lab and Confiant on the investigation and had removed Discover-Tech from its advertising platforms “for systematically violating our policies.”
IAB Europe, an association representing the digital marketing and advertising industry, said in an email that Discover-Tech had been suspended from its list of globally approved vendors the previous week, following an audit that identified policy violations.
Comcast said its advertising technology subsidiary, Beeswax, had removed Discover-Tech from its platform “following recent activity.” Yandex did not respond to Reuters’ requests for comment.
Advertising-based surveillance is increasingly being viewed as a national security threat. Earlier this year, the Pentagon said it had received reports that U.S. military personnel deployed to war zones had been targeted using location data collected by advertising technology companies and data brokers. Since then, branches of the military have disabled ad tracking on some devices.
