🇮🇱🔍📲 Adblockers are more important than ever: Israeli firm used online ads to run vast spy operation, researchers say

Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads ​that it used to track targets and help hack their devices, two research groups said on Thursday.

Its services gave Israel's Candiru — a spyware company blacklisted by the US government — as ‌well as other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia's Yandex and others, according to separate, opens new tab reports, opens new tab from Canadian cyber watchdog group Citizen Lab and New York advertising security firm Confiant.

The reports show how the online advertising business, long a subject of privacy concerns, can also serve as a channel for sweeping espionage campaigns.

"The way online advertising works today is a systemic security threat," Wolfie Christl, a senior researcher at Citizen Lab, told Reuters. "For states, the private sector, civil ​society and everyone else alike."

Discover-Tech's online ads — often for ordinary products such as phones or earbuds — reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen Lab said.

Users who ​visited sites or used apps with the malicious ads could be identified and tracked by Discover-Tech, which would sometimes also try to extract phone numbers from ⁠some smartphone users, the researchers said. Ads only needed to load on a website for the spying to occur.

Some ads would be used to help plant spyware from Candiru on users' devices, both research groups ​said, though Confiant said that ads it tied to Candiru were a tiny fraction of Discover-Tech's overall volume.

Confiant cofounder Jerome Dangu said Discover-Tech was pumping out at least ​10 million ads per day all around the world and that data-sharing arrangements — called cookie matching — allowed it to track people even beyond the reach of its advertisements.

"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.

Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech's ads had ​been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, something it said it was able to confirm because the media group had shared its network logs with the group.

Dangu of Confiant said that the malicious ads had been shown to users in "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court. He also said that some regions, like the Palestinian territories, were particularly saturated by the Israeli firm's ads.

"You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an ​entire country," he said.

Citizen Lab also said it ​had similar evidence showing the malicious ads were ⁠shown to people in the United Nations, NATO, the European Commission, and more than a dozen national governments. Other networks the ads appeared in included chip-related firms such as Nvidia, Sandisk, Broadcom, and Micron as well as several media organizations in Mexico, Israel, and Europe that were not identified.

🔗 https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

📎 https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/