Israeli Firm Accused of Using Online Ads to Distribute Spyware
Translated & summarized from Bizportal by baba
An Israeli company, Discover-Tech, allegedly used online advertising systems to distribute spyware, infecting at least 45 devices belonging to Al Jazeera employees between 2024 and 2025. The "Ad-fection" method allowed for infections without user interaction, targeting individuals in organizations like NATO and the European Commission. Google and IAB Europe have since taken action against Discover-Tech following the revelations. The company and its CEO have not commented on the findings.
The story in 6 lines · by baba
- Israeli firm Discover-Tech allegedly used online ads to distribute spyware, infecting Al Jazeera employees.
- The "Ad-fection" method infected devices without user clicks, targeting journalists and officials.
- At least 45 devices were infected with spyware from Israeli company Candiru via this platform.
- Discover-Tech attempted to purchase nearly 3.7 billion ad spaces between March and June 2026.
- Google blocked Discover-Tech, and IAB Europe suspended the company after the findings.
- The company and its CEO, Dekel Boni, have not responded to the allegations.
A new study reveals that an Israeli advertising technology company, Discover-Tech, allegedly exploited the real-time bidding system of online advertising to distribute spyware, a method dubbed "Ad-fection." This technique allowed for the infection of devices, including journalists and employees at Al Jazeera, without requiring users to click on links or download files. Discover-Tech reportedly developed a system that integrated with the digital advertising ecosystem, using data from ad auctions to identify targets and deliver malicious code.
The researchers from Citizen Lab at the University of Toronto and the American cybersecurity firm SentinelOne found that this platform was used in 2024 and 2025 against Al Jazeera personnel, infecting at least 45 devices with spyware developed by the Israeli company Candiru. Evidence also suggests the platform was used to distribute spyware from other Israeli firms, though not all infections could be confirmed. Candiru itself has been on the U.S. government's blacklist since 2021 due to its alleged involvement in spyware used for surveillance.
Discover-Tech's operations were extensive, with the company attempting to purchase ad space approximately 3.7 billion times between March and June 2026, and succeeding in about 442 million instances. Its ads appeared on over 120,000 websites and 70,000 apps, including major news sites and popular services, making exposure to malicious ads commonplace. The study indicated that some ads targeted devices of employees and officials within organizations like NATO, the European Commission, Nvidia, Arm, SanDisk, and Raytheon, as well as government, law enforcement, and critical infrastructure personnel in Northern European countries.
Following the researchers' findings, Google blocked Discover-Tech from its advertising platforms, and IAB Europe suspended the company from its global vendor list pending further investigation. Citizen Lab stated that Discover-Tech presented itself as a legitimate advertising company but acted as an intermediary between ad providers and spyware firms. Discover-Tech and its CEO, Dekel Boni, did not respond to the findings. The report raises concerns that this method, leveraging the infrastructure of digital advertising for surveillance and infection, may not be an isolated incident.
Mentioned
The same event, reported separately by each outlet. Open a few to compare what different newsrooms emphasize — and what they leave out.
Other 2
Not the same event — other stories that share this one’s people, places, or theme: background, reactions, and follow-ups.
