Israeli Firm Used Online Ads to Run Vast Spy Operation, Researchers Say
An Israeli advertising agency spied on internet users through a network of online ads used to track targets and help hack their devices, two research groups said on Thursday. The Discover-Tech spy operation ads reached more than 120,000 websites and 75,000 apps, according to Citizen Lab.
Inside the Discover-Tech spy operation ads network
Discover-Tech’s services gave Israel’s Candiru, a spyware company blacklisted by the US government, and other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia’s Yandex and others. The findings come from separate reports by Canadian cyber watchdog Citizen Lab and New York ad security firm Confiant.
The ads promoted ordinary products such as phones or earpods. Users who visited sites or used apps carrying them could be identified and tracked, and the firm sometimes tried to extract phone numbers from smartphone users. The ads only needed to load for the spying to occur.
Some ads helped plant Candiru spyware on devices, both groups said, though Confiant noted these were a tiny fraction of Discover-Tech’s total volume.
“The way online advertising works today is a systemic security threat,” Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters. “For states, the private sector, civil society and everyone else alike.”
Confiant cofounder Jerome Dangu said Discover-Tech pumped out at least 10 million ads daily, and that data-sharing arrangements known as cookie matching let it track people beyond the reach of its ads.
“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
Sensitive networks in the crosshairs
Dangu said the malicious ads appeared in “hundreds of networks in sensitive categories,” including the Pentagon, the International Atomic Energy Agency and the International Criminal Court, with the Palestinian territories particularly saturated.
“You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,” he said.
Citizen Lab found similar evidence for the United Nations, NATO, the European Commission and more than a dozen national governments, as well as chip firms such as Nvidia, Sandisk, Broadcom and Micron and unidentified media organisations in Mexico, Israel and Europe.
Discover-Tech inadvertently exposed its authentication logs, showing logins from IP addresses in Israel, Europe and the Gulf. Citizen Lab said Candiru spyware delivered through the ads compromised 45 Windows devices at Al Jazeera between 2024 and 2025, confirmed through shared network logs.
Platforms move to shut Discover-Tech out
Google kicked Discover-Tech off its ad platforms “for systematically violating our policies.” IAB Europe suspended the firm from its approved-vendor list, Comcast’s Beeswax removed it, and Yandex did not respond to requests for comment.
Earlier this year, the Pentagon said US forces in war zones had been targeted using location data harvested by ad tech firms. Military branches have since disabled ad tracking on some devices. The episode fits a broader pattern of digital threats: Google has warned of a major cyber threat by 2029, and researchers keep finding new ways attackers reach ordinary users.
Discover-Tech, founded in 2020, did not return messages sent through its contact form, and emails to chief executive Dekel Boni went unanswered. Reuters could not reach Candiru’s owners. The US Commerce Department blacklisted Candiru in 2021 for allegedly supplying spyware used against officials, journalists, activists and academics.
How phone users in Pakistan can stay safe
No Pakistan-specific victim has been reported, but the same ad networks reach phones everywhere. Users can lower their exposure with a few practical steps.
First, limit ad tracking in the phone’s privacy settings: both Android and iOS let users switch off ad personalisation and reset the advertising ID. Second, review app permissions and remove access apps do not need. Third, install system and app updates promptly, since updates close the flaws spyware relies on. Ad blockers and regular mobile ad ID resets help higher-risk users further. Readers following Pakistan’s WhatsApp hacking alert will recognise the pattern; cyber defence sits with Federal CERT Pakistan, while the NCERT-HEC partnership builds expertise in universities.
What is Discover-Tech?
An Israeli digital advertising agency that researchers say acted as a front for large-scale spying through online ads.
How did the ads spy on users?
The ads tracked visitors across more than 120,000 websites and 75,000 apps, sometimes extracting phone numbers. Some also delivered Candiru spyware.
Who was affected?
Potentially hundreds of millions of people worldwide. The ads also hit sensitive networks including the Pentagon, the UN, NATO and the ICC.
What can phone users do to protect themselves?
Limit ad tracking in phone settings, review app permissions, keep devices updated, and consider ad blockers and regular resets of the mobile ad ID.
