Israeli Firm Discover-Tech Accused of Aiding Espionage Through Online Ads

The Israeli digital advertising agency Discover-Tech allegedly spied on internet users globally by using a vast network of online advertisements to monitor targets and breach devices, according to two research organizations. Reports from Canada's Citizen Lab and New York-based security firm Confiant indicate that Discover-Tech's services provided Israeli cyber-espionage firm Candiru, which is sanctioned by the U.S. government, and other Israeli spyware companies access to advertising platforms managed by Google, Comcast, Yandex, and others. Neither Discover-Tech nor Candiru responded to Reuters' inquiries.

Citizen Lab claims that a potent version of Candiru's spyware, distributed via Discover-Tech's ads, was used to infiltrate 45 Windows computers at Qatar's Al Jazeera network in 2024-2025. The organization verified this information after the media group shared its network logs. Al Jazeera also did not comment.

Discover-Tech works with various ad platforms to display ads, many of which contain code that transmits user identifiers like cookies to the company. While most ads only collect browser data, some were found to facilitate the installation of Candiru spyware. Confiant noted that Candiru-related ads constituted a small fraction of Discover-Tech's overall activity.

Candiru, though less known than NSO Group, is a major player in commercial spyware. Both companies were blacklisted by the U.S. Department of Commerce in 2021, leading Candiru into a severe commercial crisis, from which it appears to have recovered and continues to innovate.

"The way online advertising works today is a systemic security threat," stated Wolfie Crystal, a senior researcher at Citizen Lab. Discover-Tech's ads, often for everyday products, appeared on over 120,000 websites and 75,000 apps. Users visiting these sites or using these apps were identified and monitored, with Discover-Tech sometimes attempting to extract phone numbers from smartphone users. Confiant's founder, Jerome Dangu, estimated that Discover-Tech served at least 10 million ads daily worldwide, with data-sharing agreements allowing monitoring beyond the ads' direct reach, potentially affecting hundreds of millions of people. These malicious ads were reportedly displayed across "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court. Palestinian territories, among other areas, saw particularly extensive exposure.

Dr. Bill Marczak of Citizen Lab explained that the advertising ecosystem's ability to push arbitrary, personalized content to specific users is a "match made in heaven" for the spyware industry, predicting more such attacks until the industry self-regulates or regulators intervene. Citizen Lab has similar evidence of malicious ads targeting users in the U.S., NATO, and EU countries. The ads also appeared on networks of companies like Nvidia, SanDisk, and Broadcom, as well as telecommunication networks in Mexico, Israel, and Europe.

Google stated it cooperated with the investigations and removed Discover-Tech's ads for repeated policy violations. Beeswax, a Comcast subsidiary, also blocked Discover-Tech, and IAB Europe suspended the company from its authorized vendor list.