Newsletters
An Israeli digital advertising company used seemingly ordinary online advertisements to track internet users and help surveillance firms infect targeted devices with spyware, Reuters reported Thursday, citing cybersecurity researchers.
Discover-Tech provided Israeli spyware company Candiru and other surveillance firms with access to advertising networks operated by major technology companies, including Google, Comcast subsidiary Beeswax and Russia's Yandex, according to researchers at the University of Toronto's Citizen Lab and New York-based advertising security firm Confiant.
The advertisements, some promoting everyday consumer products such as phones and wireless earbuds, appeared across more than 120,000 websites and 75,000 mobile apps through Discover-Tech's advertising partnerships, Citizen Lab found.
Researchers said users did not need to click on the advertisements to become targets. Simply loading a webpage or application containing one of the ads could allow Discover-Tech to identify and track a device.
Some operations also sought to obtain phone numbers from smartphone users.
Citizen Lab said the infrastructure could be used to deliver zero-click spyware, potentially compromising devices without requiring any action from their owners.
The organization described its findings as the first public technical confirmation of mercenary spyware being delivered through targeted online advertising.
Confiant co-founder Jerome Dangu told Reuters that Discover-Tech distributed at least 10 million advertisements daily worldwide.
He said data-sharing arrangements within the digital advertising industry could also allow users to be tracked beyond the websites displaying the company's advertisements.
"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.
Confiant found that the advertisements appeared in hundreds of sensitive networks, including those belonging to the Pentagon, International Atomic Energy Agency and International Criminal Court.
Citizen Lab also identified evidence of the advertisements reaching networks associated with the United Nations, NATO, European Commission and more than a dozen national governments.
Corporate networks belonging to semiconductor manufacturers Nvidia, Sandisk, Broadcom and Micron were among those where the advertisements appeared, researchers said.
Dangu told Reuters that Discover-Tech's advertising activity was particularly extensive in the Palestinian territories.
"You go to almost any site in Palestine—any site—you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country," he said.
The presence of the advertisements on these networks does not, by itself, establish that their systems were compromised by spyware.
Citizen Lab said Discover-Tech's advertising infrastructure was used to deliver spyware developed by Candiru to 45 Windows devices at Qatar-based broadcaster Al Jazeera between 2024 and 2025.
Researchers confirmed the infections after Al Jazeera provided network logs for analysis.
Candiru, which has since rebranded as Integrity Labs, was placed on a U.S. Commerce Department blacklist in 2021 over allegations that its spyware had been used to target government officials, journalists, activists and academics.
Citizen Lab also identified connections between Discover-Tech and other surveillance and hacking companies, including Bindecy and Intelos.
Discover-Tech did not respond to Reuters' requests for comment. Attempts to contact Candiru's owners were also unsuccessful, the news agency reported.
Several technology companies and advertising industry organizations have taken action against Discover-Tech following the investigations, Reuters reported.
Google said it cooperated with Citizen Lab and Confiant before removing Discover-Tech from its advertising platforms over what it described as systematic violations of its policies.
IAB Europe, an industry association representing the digital advertising sector, suspended Discover-Tech from its list of approved vendors after an audit identified policy violations.
Comcast's advertising technology subsidiary Beeswax also removed the company from its platform following recent activity.
Yandex did not respond to Reuters' request for comment.
The findings raise broader concerns about how information gathered through online advertising systems can be exploited for surveillance and intelligence operations.
Citizen Lab said the investigation demonstrated how technology originally designed to identify consumers and deliver targeted advertisements could instead be used to identify individuals, monitor their online activities and, in some cases, compromise their devices.
Set as preferred source
Set as preferred source
3 min read
1 min read
