Two research groups mentioned on Thursday that the Israeli digital advertising agency Discover-Tech spied on internet users through a vast network of online advertisements that it used to track specific targets and aid in hacking their devices.
Two separate reports released by the Canadian cybersecurity monitoring group Citizen Lab and the New York-based advertising security company Confiant stated that Discover-Tech's services provided Israeli spyware company Candiru, which is blacklisted by the U.S. government, as well as other Israeli surveillance companies, access to advertising platforms managed by Google, Comcast, Russian Yandex, and others.
The reports demonstrated how the online advertising sector, which has long raised privacy concerns, can also serve as a channel for conducting large-scale espionage campaigns.
Cybersecurity experts warned iPhone users about sophisticated malware capable of concealing its activity while taking control of the camera and microphone.
Israeli spying on internet users
Citizen Lab researcher Wolfie Kristel told Reuters: “The way online advertising works today represents a systemic security threat.”
He added that this applies to “countries, the private sector, civil society, and everyone alike.”
Citizen Lab reported that Discover-Tech’s online ads, which often promoted ordinary products like phones and earbuds, reached over 120,000 websites and 75,000 apps through its various partnerships.
Researchers stated that users who visited sites or used apps featuring malicious ads could be identified and tracked by Discover-Tech, which sometimes also attempted to extract phone numbers from some smartphone users, and the ads only needed to appear on a website for spying to occur.
The research groups noted that some ads were used to help implant spyware from Candiru on users’ devices, but Confiant stated that the ads it linked to Candiru represented only a small portion of the overall volume of Discover-Tech ads.
A WhatsApp official said that the Israeli spyware company Paragon Solutions targeted dozens of users, including journalists and civil society members.
10 million ads daily
Confiant co-founder Jerome Doucet stated that Discover-Tech broadcast at least 10 million ads daily worldwide, and data-sharing arrangements known as "Cookie Matching" allowed it to track individuals even outside the reach of its ads.
Doucet added: “It is highly likely that hundreds of millions of people have been affected by Discover-Tech’s activities.”
Discover-Tech, founded in 2020, did not respond to messages sent via its contact form.
Reuters did not receive any reply to a message sent through LinkedIn and emails sent to its CEO Dekel Boni.
Attempts by Reuters to reach the owners of Candiru were unsuccessful.
The U.S. Department of Commerce blacklisted the company in 2021 for providing spyware used to maliciously target government officials, journalists, activists, and academics.
Apple and WhatsApp, a subsidiary of Meta Platforms, pledged to continue warning their users if their phones are targeted by governments using advanced spyware against them.
An advanced form of spyware
Citizen Lab stated that an advanced form of spyware from Candiru, distributed via Discover-Tech ads, was used to hack 45 Windows devices at Al Jazeera Network in 2024 and 2025.
It added that it was able to verify this after the media organization shared its network logs with the group.
Al Jazeera did not respond to requests for comment.
Doucet stated that the malicious ads were presented to users across “hundreds of networks in sensitive sectors,” including the U.S. Department of Defense (Pentagon), the International Atomic Energy Agency, and the International Criminal Court.
He added that some areas, such as the Palestinian territories, were particularly saturated with the Israeli company’s ads.
Doucet continued: “If you visit any site in Palestine… any site, you will find a Discover-Tech ad, giving it nearly complete visibility into the digital activities of an entire country.”
Citizen Lab said it has similar evidence showing that malicious ads were shown to individuals working at the United Nations, NATO, the European Commission, and more than 12 other governments.
The networks where the ads appeared also included companies linked to the semiconductor industry such as Nvidia, SanDisk, Broadcom, and Micron, as well as a number of unnamed media outlets in Mexico, Israel, and Europe.
In addition to identifying Candiru and several other surveillance tech suppliers, Citizen Lab said it managed to extract some details about the possible locations of Discover-Tech users because the company inadvertently exposed its verification logs online, which showed logins from IP addresses in Israel, Europe, and the Gulf region.
Actions against Discover-Tech
Discover-Tech has currently been excluded from parts of the digital advertising market.
Google stated in a statement that it cooperated with the investigation conducted by Citizen Lab and Confiant and banned Discover-Tech from its advertising platforms "for systematically violating our policies."
IAB Europe, the European association for the digital marketing and advertising ecosystem, in an email message said that Discover-Tech was suspended from its list of globally approved suppliers last week after an audit revealed policy violations.
Comcast stated in a statement that its ad tech company Beeswax removed Discover-Tech from its platform "following recent activities."
Yandex did not respond to Reuters’ requests for comment.
Ad-based surveillance is increasingly viewed as a national security threat.
Earlier this year, the U.S. Department of Defense stated that it received reports indicating that U.S. military personnel deployed in war zones had been targeted using location data collected by advertising tech companies and data brokers.
Since then, branches of the U.S. military have disabled ad tracking features on some devices.