WorldMiddle East
Israeli ad firm used online adverts to track users and plant spyware, researchers say
Citizen Lab and Confiant say Discover-Tech's ads, seen on more than 120,000 websites, gave surveillance firms including Candiru a way into people's devices. Google has dropped the company.
Key points
- Discover-Tech's ads ran on more than 120,000 websites and 75,000 apps, Citizen Lab said.
- Candiru spyware delivered through the ads compromised 45 Windows devices at Al Jazeera.
- Google removed Discover-Tech from its ad platforms.
An Israeli digital advertising agency used ordinary-looking online adverts for phones and earbuds to track people and help hack their devices, two groups of security researchers said on Thursday.
Citizen Lab, the Canadian cyber watchdog, and Confiant, a New York advertising security firm, published separate reports on Discover-Tech, an agency founded in 2020. They said its services gave the Israeli spyware maker Candiru, blacklisted by the US in 2021, and other Israeli surveillance firms access to advertising platforms run by Google, Comcast and Russia’s Yandex.
The ads did not need to be clicked. Simply loading one on a website or app could identify and track the user, and in some cases the firm tried to pull phone numbers from smartphones. A small share of the ads helped plant Candiru spyware. Citizen Lab said a powerful form of that spyware, delivered this way, compromised 45 Windows devices at Al Jazeera between 2024 and 2025.
How far it reached
Citizen Lab said Discover-Tech’s ads appeared on more than 120,000 websites and 75,000 apps. Confiant said the firm placed at least 10 million ads a day around the world. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” said Jerome Dangu, Confiant’s co-founder, adding that the Palestinian territories were especially saturated.
The researchers found malicious ads inside networks at the Pentagon, the International Atomic Energy Agency and the International Criminal Court, and evidence of ads shown to people at the UN, NATO and the European Commission.
“The way online advertising works today is a systemic security threat,” said Wolfie Cristl, a senior researcher at Citizen Lab.
Google said it had worked with the researchers and removed Discover-Tech from its platforms for breaking its rules. IAB Europe said it had suspended the firm from its list of approved vendors last week, and Comcast’s ad tech arm Beeswax also dropped it. Discover-Tech and its chief executive, Dekel Boni, did not respond to requests for comment.