WASHINGTON: Israeli digital advertising firm Discover-Tech used a broad network of online ads to identify and track internet users, and in some cases help deliver spyware to their devices, according to investigations by Canadian research group Citizen Lab and US advertising-security firm Confiant.
The findings highlight how the digital advertising system—already criticised over privacy risks—can potentially be exploited for surveillance. Discover-Tech’s ads, which often promoted everyday products such as phones and earbuds, appeared across more than 120,000 websites and 75,000 apps through its advertising partnerships, Citizen Lab said.
The researchers said an ad did not necessarily need to be clicked: simply loading a page or app displaying one could allow the firm to identify and monitor a user. Some ads were also used to facilitate the installation of spyware developed by Candiru, an Israeli surveillance company placed on a US government blacklist in 2021. Confiant said ads it linked to Candiru represented only a small share of Discover-Tech’s overall advertising activity.
Discover-Tech’s access to advertising platforms operated by companies including Google, Comcast and Russia’s Yandex reportedly enabled surveillance firms to reach users through the wider online-ad ecosystem. The reports also describe data-sharing practices known as “cookie matching,” which can help companies connect identifiers and follow users beyond the sites where a particular ad appears.
Confiant co-founder Jerome Dangu estimated that Discover-Tech distributed at least 10 million ads a day worldwide. Given the firm’s data-sharing arrangements, he said, the number of people exposed to its activity could have reached hundreds of millions.
Alleged targeting of sensitive organisations
Citizen Lab said it found evidence that Candiru spyware delivered through Discover-Tech ads was used to compromise 45 Windows devices at Qatar-based broadcaster Al Jazeera between 2024 and 2025. The group said it was able to investigate after Al Jazeera shared network logs.
Al Jazeera said it condemned spyware attacks against some of its staff and was working to protect its employees and systems. It called for those responsible to be held accountable.
Confiant said the ads appeared across hundreds of networks in sensitive sectors, including those associated with the Pentagon, the International Atomic Energy Agency and the International Criminal Court. It also described Discover-Tech advertising as particularly widespread in Palestinian territories, claiming the ads appeared on a broad range of local websites.
Citizen Lab reported similar evidence involving networks connected to the United Nations, NATO, the European Commission and more than a dozen national governments. The ads were also found in networks associated with semiconductor companies, including Nvidia, Sandisk, Broadcom and Micron, as well as media organisations in Mexico, Israel and Europe.
The group said it identified possible locations of Discover-Tech users after finding authentication logs exposed online. The records showed logins from internet protocol addresses in Israel, Europe and the Gulf. The reports did not establish the identities of all the firm’s customers or the full extent of its surveillance operations.
Advertising platforms take action
Several companies and industry bodies have moved to restrict Discover-Tech’s access. Google said it worked with Citizen Lab and Confiant and removed the firm from its advertising platforms for what it described as systematic policy violations.
IAB Europe said it suspended Discover-Tech from its list of globally approved vendors after an audit found policy breaches. Comcast said its advertising technology subsidiary, Beeswax, removed the company from its platform following recent activity. Yandex did not respond to Reuters’ requests for comment.
Discover-Tech, founded in 2020, did not respond to messages sent through its contact form or to emails and a LinkedIn message addressed to its chief executive, Dekel Boni. Reuters also reported that attempts to contact Candiru’s owners were unsuccessful.
The case comes amid growing concern that commercial advertising data can create national-security risks. Earlier this year, the Pentagon said US forces deployed in conflict zones had reportedly been targeted using location information obtained from advertising technology companies and data brokers. Some branches of the US military have since disabled ad tracking on certain devices.
