Wired for War: Israeli firm ran global surveillance operation through online ads, investigation finds

Discover-Tech exploited digital advertising infrastructure to track targets and deliver spyware, according to two research teams

Israeli ad tech company Discover-Tech exploited online advertising infrastructure to track targets and help deliver spyware to dozens of devices belonging to Al Jazeera staff and members of other entities, according to investigations by the Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.

The researchers said Discover-Tech used a sprawling network of online ads to identify potential targets, monitor their activity and facilitate the compromise of their devices.

"The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting," Confiant said in its findings.

Devices belonging to staff at the international news network Al Jazeera were among those infected through malicious ad placements, which operated silently, without visible pop-ups or suspicious links. The Qatar-based media network condemned "the spyware attacks targeting a number of its staff," describing them as an "assault on press freedom," and called for those responsible to be held accountable.

The investigation also linked the malicious activity to Israeli spyware developer Candiru, which has been blacklisted by the US and rebranded as Integrity Labs, and Israeli surveillance technology provider Intelos. The companies allegedly exploited ad inventory on major platforms, including Google, Russia's Yandex and US ad tech platform Beeswax to track targets and compromise consumer devices.

Geographic data revealed sharp spikes in traffic that researchers said pointed to targeted intelligence-gathering operations rather than routine commercial advertising. Palestine was the most heavily targeted territory, where Discover-Tech accounted for nearly 2% of all digital ad impressions, peaking at around 10% on April 7. The activity also reached sensitive networks, including the Armenian prime minister's office, international organizations, courts, universities and defense institutions. Investigators detected targeted connections to Candiru servers in nine countries, with Belgium accounting for 56% of recorded activity, followed by the UAE, Saudi Arabia, Bahrain, Mexico and Spain.

Confiant described the campaign as highly sophisticated, citing its anti-interception measures and precise targeting capabilities. Citizen Lab said the findings provided the first public technical evidence that spyware could be delivered through online ads without users clicking on anything, a technique researchers dubbed "AdFection."