An Israeli digital advertising company allegedly used millions of seemingly ordinary online advertisements to track internet users and help spyware operators hack their devices, according to two investigations published Thursday, exposing how global advertising networks can be exploited for surveillance.
Discover-Tech, an Israeli company founded in 2020, operated an extensive network of advertisements that reached more than 120,000 websites and 75,000 mobile applications, according to separate reports by Canadian cybersecurity research organization Citizen Lab and New York-based advertising security company Confiant.
Israeli ad firm accused of spying through millions of online ads and helping hackers plant spyware
(Photo: Shutterstock)
The researchers said Discover-Tech's services gave Israeli surveillance companies, including US-blacklisted spyware developer Candiru, access to major digital advertising platforms operated by Google, Comcast, Russia's Yandex and other companies.
The advertisements often promoted ordinary consumer products, including smartphones and earbuds. However, simply loading one of the ads could allow Discover-Tech to identify and track a user, even without clicking it. In some cases, the company allegedly attempted to obtain smartphone users' phone numbers.
"The way online advertising works today is a systemic security threat," Citizen Lab senior researcher Wolfie Christl told Reuters. "For states, the private sector, civil society and everyone else alike."
According to Confiant cofounder Jerome Dangu, Discover-Tech distributed at least 10 million advertisements daily worldwide. Data-sharing arrangements between advertising platforms, known as cookie matching, reportedly allowed the company to follow users beyond websites displaying its ads.
"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.
The investigations also linked some of the advertisements to attempts to install spyware developed by Candiru, an Israeli surveillance company blacklisted by the US Commerce Department in 2021 for allegedly supplying technology used to target government officials, journalists, activists and academics.
Confiant emphasized that advertisements linked to Candiru accounted for only a tiny fraction of Discover-Tech's overall advertising activity.
Citizen Lab said it confirmed that Candiru spyware delivered through Discover-Tech's advertisements compromised 45 Windows computers belonging to the Qatari broadcaster Al Jazeera between 2024 and 2025. Researchers said they verified the infections using network records provided by the broadcaster.
Al Jazeera condemned the attacks on its employees and said it was strengthening its security measures.
"Those responsible must be held accountable," the broadcaster said.
The advertisements also appeared across networks belonging to sensitive institutions worldwide. According to Confiant, these included the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab identified similar activity involving networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments.
Researchers also found the advertisements on networks associated with major semiconductor companies, including Nvidia, Sandisk, Broadcom and Micron, as well as unidentified media organizations in Israel, Mexico and Europe. Their appearance on those networks does not necessarily mean the institutions' systems were compromised.
Dangu said the Palestinian territories were particularly heavily targeted by Discover-Tech advertisements.
"You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country," he said.
Citizen Lab also discovered that Discover-Tech had inadvertently exposed authentication records showing users accessing its services from internet addresses in Israel, Europe and the Gulf.
Following the investigations, major advertising companies began removing Discover-Tech from their systems. Google confirmed that it had worked with Citizen Lab and Confiant and expelled Discover-Tech from its platforms for "systematically violating our policies."
The European digital advertising association IAB Europe suspended the company from its list of approved vendors last week after identifying policy violations, while Comcast subsidiary Beeswax also removed it from its advertising platform.
Discover-Tech did not respond to Reuters' requests for comment. Its chief executive, Dekel Boni, also did not respond to messages, and efforts to contact Candiru's owners were unsuccessful. Yandex did not respond to requests for comment.
The findings come amid growing concerns that digital advertising technology poses national security risks. Earlier this year, the Pentagon said US military personnel deployed to war zones had been targeted using location data collected by advertising technology companies and data brokers, prompting parts of the military to disable advertising tracking on certain devices.