Israeli company used online ads for mass espionage

Ads related to the spyware also appeared on the websites of EU and NATO institutions, and researchers estimate that Discover-Tech's activities likely affected hundreds of millions of people.

Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of ads, using them to track selected targets and facilitate hacking attacks on their devices, two research organizations said yesterday.

The agency's services allowed Israeli spyware maker Candiru, blacklisted by US authorities, and other Israeli surveillance firms to access advertising platforms operated by Google, Comcast, Russia's Yandex and other companies, according to separate reports by Canadian cyber threat research organization Citizen Lab and New York-based digital advertising security firm Confiant.

Reports show how the online advertising industry, which has long raised concerns privacy violations, can also serve as a vehicle for conducting large-scale espionage operations.

“The way online advertising works today poses a systemic security threat,” Wolfi Kristl, a senior researcher at Citizen Lab, told Reuters. “That applies to states, the private sector, civil society and everyone else.”

Discover-Tech's ads, often for common products like phones or wireless headphones, were shown on more than 120.000 websites and in 75.000 apps thanks to the company's partnerships, Citizen Lab said.

According to data reported by Politico, researchers analyzed four billion online advertising records over four months, and the presence of Discover-Tech ads was recorded in dozens of countries.

Discover-Tech was able to identify and track users who visited websites or apps that displayed malicious ads, and in some cases even attempted to obtain their mobile phone numbers, the researchers said. All it took to spy was for the ad to load on a website.

Some of the ads were also used to help install spyware from Israeli company Candiru on users' devices, both research organizations said. However, Confiant said the ads it linked to Candiru made up only a small portion of Discover-Tech's total ads.

This method uses a system of automatic real-time advertising space purchase ( real-time bidding ), which allows advertisers to target specific users. Instead of tricking the victim into clicking on a malicious link, attackers can use the ads to identify devices and potentially infect them with spyware, without any user action. Such attacks are known as “zero-click” attacks.

Malicious ads reach the Pentagon, NATO and the UN

Confiant co-founder Jerome Dangu said Discover-Tech placed at least 10 million ads worldwide every day, and that data-sharing agreements, known as cookie matching, allowed it to track users even beyond the reach of its own ads.

“It is highly likely that Discover-Tech’s activities have in some way affected hundreds of millions of people,” Dangu said.

Discover-Tech, founded in 2020, did not respond to Reuters requests for , nor did its CEO Dekel Boni.

Reuters' attempts to the owners of Candiru were unsuccessful. The US Department of Commerce blacklisted Candiru in 2021 over allegations that the company supplied spyware used to attack government officials, journalists, activists and academics. According to Politika, Candiru was acquired by Integrity Labs in 2025.

Citizen Lab said at least 45 devices at Qatari broadcaster Al Jazeera were targeted by hackers in 2024 and 2025, using ads from Discover-Tech. The researchers confirmed that some of the devices were infected with the Candiru spyware, based on analysis of network traffic data provided by Al Jazeera. The broadcaster did not respond to a Reuters request for .

Confiant's Jerome Dangu said the malicious ads were displayed to users on "hundreds of networks of sensitive institutions," including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He said that certain areas, such as the Palestinian territories, were particularly exposed to the Israeli company's ads.

Citizen Lab said it has similar evidence that malicious ads were also shown to users at the United Nations, NATO, the European Commission and government institutions in more than a dozen other countries. Politiko reports that the ads also appeared on the websites of the European Parliament and the Council of the EU.

Google and other organizations take action against Discover-Tech

Discover-Tech has begun to lose access to a portion of the online advertising market.

Google said it had worked with researchers from Citizen Lab and Confiant and had removed Discover-Tech from its advertising platforms "for systematic violations of our policies."

The European Association for Digital Marketing and Advertising (IAB Europe) said it suspended Discover-Tech from its list of approved service providers last week after an audit found violations of its rules.

Surveillance through online advertising is increasingly recognized as a threat to national security. The Pentagon said earlier this year that it had received reports that US forces deployed in war zones were being tracked using location data collected by digital advertising companies and data brokers. Some branches of the US military have since disabled ad tracking on some of their devices.

Politiko writes that the revelations have also raised concerns in the European Parliament. German Green MP Hanna Neumann warned that the possibility that EU institutions were exposed to espionage should raise alarm in Brussels.

"Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware," said Neumann, who herself was previously the target of cyber espionage by an Iranian hacking group.