An Israeli digital advertising company allegedly used ordinary online advertisements to track internet users and help deliver powerful spyware to targeted devices, according to investigations by Canadian cyber watchdog Citizen Lab and New York based advertising security firm Confiant.
The findings have raised fresh concerns about the security risks hidden within the global online advertising industry, where advertisements designed to promote everyday products can potentially be used for surveillance and cyber espionage.
The researchers said Discover Tech, an Israeli advertising company founded in 2020, operated an extensive network that reached more than 120,000 websites and 75,000 applications. Its advertisements included promotions for ordinary products such as mobile phones and earbuds.
According to the investigations, users could be identified and tracked when the advertisements loaded on websites or applications. Researchers also said some advertisements were used to help deliver spyware developed by Candiru, an Israeli surveillance company blacklisted by the US government in 2021 over allegations involving the targeting of government officials, journalists, activists and academics.
Citizen Lab said it found evidence linking a powerful form of Candiru spyware delivered through Discover Tech advertisements to the compromise of 45 Windows devices at Qatar based broadcaster Al Jazeera between 2024 and 2025.
Confiant co founder Jerome Dangu said Discover Tech was delivering at least 10 million advertisements each day around the world. He said data sharing systems used by advertising companies could potentially allow the tracking of users beyond websites where the company’s advertisements appeared.
The researchers said the advertisements appeared in networks connected to sensitive organisations, including the Pentagon, the International Atomic Energy Agency, the International Criminal Court, the United Nations, NATO and the European Commission.
The Palestinian territories were also identified as an area where Discover Tech advertisements appeared extensively, according to Confiant.
Discover Tech did not respond to requests for comment. Reuters also reported that attempts to reach Candiru’s owners were unsuccessful.
Major advertising companies have since taken action. Google said it removed Discover Tech from its advertising platforms after working with the researchers and finding systematic policy violations. IAB Europe also suspended the company from its approved vendor list, while Comcast advertising subsidiary Beeswax removed it from its platform.
The case highlights a wider issue for internet users: advertising technology can collect vast amounts of information, and researchers warn that the same systems created for commercial targeting can potentially be exploited for surveillance.
Leave a comment