Israeli Ad Agency Discover-Tech Linked to Global Spyware Operations
Israeli ad agency Discover-Tech used online ads to track global internet users and facilitate spyware deployment for firms like Candiru, targeting major networks.
Discover-Tech Exposes Web Users Through Ad Networks
The Israeli digital advertising agency Discover-Tech tracked internet users worldwide using an extensive network of online advertisements to monitor targets and hack devices, according to two research institutions. A report published by Canada's Citizen Lab and New York-security firm Confiant revealed that the company's services provided Candiru, an Israeli offensive cyber firm blacklisted by the US government, and other spyware firms access to ad platforms managed by Google, Comcast, and Yandex.
Although not as publicly well-known as NSO Group, Candiru remains a central player in the commercial spyware industry. Alongside NSO, it was one of two Israeli firms placed on the US Commerce Department's blacklist in 2021, triggering severe commercial crises. However, the company has reportedly weathered the storm, continuing to operate and innovate within its sector.
Scale of Surveillance and Global Reach
"The way online advertising works today constitutes a systemic security threat for governments, private companies, civil society, and everyone else," said John Scott-Railton, a senior researcher at Citizen Lab.
According to the investigation, Discover-Tech's online ads—often disguised as everyday products like headphones or phones—appeared on more than 120,000 websites and 75,000 applications. Users who visited these sites or used the applications were tracked by Discover-Tech, which sometimes attempted to extract phone numbers from smartphone users. Merely loading the advertisement on a webpage was sufficient to initiate the tracking process.
Both studies found that certain ads were utilized to help plant Candiru spyware onto user devices. Confiant founder Jerome Dangu noted that Discover-Tech served at least 10 million ads daily worldwide, utilizing cookie matching agreements to monitor individuals beyond the immediate reach of the ads. Dangu stated that hundreds of millions of people were likely affected by the firm.
Targeting Media and International Bodies
According to Citizen Lab, a potent version of Candiru's spyware, distributed via Discover-Tech's ads, was used to hack 45 Windows-based computers at Qatari broadcaster Al Jazeera between 2024 and 2025. Dangu added that malicious ads were displayed to users across sensitive networks, including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
Google stated that it cooperated with the investigations by Citizen Lab and Confiant, subsequently removing Discover-Tech's advertisements from its platforms due to repeated policy violations.
