Israeli Firms Accused of Using Ads to Distribute Spyware

Israeli companies are reportedly at the center of a new investigation into the use of digital advertising systems to spread spyware. A study published by Citizen Lab at the University of Toronto attributes activities to the Israeli firm Discover-Tech, which allegedly used advertisements on websites and apps to infiltrate spyware into devices. According to the researchers, this technology was used to target devices belonging to employees of the Al Jazeera news network, employing spyware from the Israeli company Candiru, now operating as Integrity Labs. The study claims that 45 Windows-based computers at Al Jazeera were compromised by the spyware in 2024 and 2025, based on traffic data provided by the network itself. The findings, which require further investigation into the companies' responsibility and the identity of those who commissioned the operations, highlight a unique method where merely viewing an advertisement could be sufficient to activate malicious code, a technique researchers call "Ad-fection."

Discover-Tech allegedly exploited the standard digital ad purchasing infrastructure, which allows advertisers to target specific users based on data like location and device characteristics. This system, often involving rapid automated auctions between advertisers, was allegedly used by Discover-Tech to deliver code designed to collect information or launch surveillance attacks on selected devices. The researchers identified a system named "Controllium," attributed to Discover-Tech, which they claim enabled tracking and targeted distribution of spyware. The study links this system to several offensive cyber and digital intelligence firms, noting a high degree of certainty in identifying the attack chain based on communication data between compromised devices and servers associated with the spyware.

The report indicates that this activity extends beyond the Al Jazeera case, with Discover-Tech ads appearing on approximately 200,000 websites and apps globally over four months, based on an analysis of nearly four billion ad auction records. While displaying an ad signifies exposure to the advertising infrastructure, it does not confirm a spyware infection on all affected devices. However, the findings have already prompted action from major advertising players. Google has disconnected Discover-Tech from its ad trading systems, and the European Advertising Standards Alliance has removed the company from its list of approved providers. Other ad-buying platforms are also taking steps to limit its operations. According to the ad security firm Confiant, a partner in the research, Discover-Tech served at least 10 million ads daily, with Candiru-linked ads being a small fraction. Candiru itself has been on the U.S. Department of Commerce's blacklist since 2021.

The revelations raise significant questions about the ability of advertising companies to detect misuse of their tools, especially when malicious actors attempt to conceal their activities. Discover-Tech and Candiru did not respond to requests for comment. Two other Israeli companies mentioned, Adtimizer and Wallasim, denied involvement in the alleged spyware operations. The article notes that the Israeli cyber industry is known globally for advanced data collection and device infiltration systems, with past controversies involving companies like Paragon and Cellebrite. The current report introduces a new concern for the advertising industry, suggesting that the infrastructure used for targeted advertising could also be exploited for identifying individuals and distributing malware. Researchers are urging advertising companies and regulators to re-examine control mechanisms for vendors and software components activated through ads, and to investigate how a company presenting itself as an ad provider could operate within major international systems for years.