An engineer handles a cyber attack. (Credit: Thomas Samson/AFP)
Two research groups said Thursday that Israeli digital advertising firm Discover-Tech used an extensive network of online ads to track internet users and facilitate the hacking of their devices.
Its services gave Israel's Candiru — a spyware company blacklisted by the U.S. government — as well as other Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia's Yandex and others, according to separate reports from Canadian cyber watchdog group Citizen Lab and New York advertising security firm Confiant.
According to Confiant cofounder Jerome Dangu, Discover-Tech was putting out at least 10 million ads per day all around the world and that data-sharing arrangements — called cookie matching — allowed it to track people even beyond the reach of its advertisements. "Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.
The findings highlight how online advertising can be exploited to conduct large-scale espionage operations. Discover-Tech's online ads — often for ordinary products such as phones or earbuds — reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen Lab said.
Users who visited sites or used apps with the malicious ads could be identified and tracked by Discover-Tech, which would sometimes also try to extract phone numbers from some smartphone users, the researchers said.
Some ads would be used to help plant spyware from Candiru on users' devices, both research groups said, though Confiant said that ads tied to Candiru were a fraction of Discover-Tech's overall volume.
The spyware was planted on the devices, using the first-known instance of "zero-click" targeted advertising. In other words, the spyware was allegedly delivered through online advertisements, without the users having to click on anything. Once a device is infected, all the data and information available on that platform become available to those stealing it.
According to Al Jazeera, the malicious software is "designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials, and can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms."
The spyware tool is understood to have cost several million dollars, according to the Qatari broadcaster, which added that it used techniques that allow it to bypass modern security defenses.
Confiant said in a separate report that some of Discover-Tech’s advertisements also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.
Targeting Al Jazeera
Meanwhile, Citizen Lab said that the spyware delivered had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, something it was able to confirm when the media group shared its network logs with it.
Al Jazeera Media Network on Thursday said it "condemns the spyware attacks targeting a number of its staff" and pledged to continue to "protect its employees and systems." The broadcaster said targeting journalists is an "assault on press freedom" and called for those responsible to be held accountable.
Candiru’s spyware has previously been used to carry out surveillance on at least 100 journalists, dissidents and others in several countries, according to Al Jazeera.
Reminiscent of Pegasus scandal
Contacted by L'Orient Today, cybersecurity expert Roland Abi Najem said that "zero-click" attacks have happened on a number of occasions since 2016, including the famous Pegasus scandal.
Pegasus, a spyware developed by Israeli cyber-intelligence firm NSO Group, is capable of accessing a phone's microphone, camera, and files. It was at the heart of a scandal revealed in 2021 by a consortium of international news organizations, which revealed that it was being used by dozens of states to spy on hundreds of people around the world, including journalists and politicians.
Asked about whether there are measures that could be taken to protect against such attacks, the expert said that updating one's phone to the latest iOS and keeping apps up to date can minimize the risk of hacking but not eliminate it. "Even if a user made all the necessary updates, hackers could still find vulnerabilities to penetrate a phone and access its data. These are called 'zero-day' attacks, meaning that the hackers find vulnerabilities in Windows, iOS, or Android and hack them before these companies discover the vulnerabilities, " Abi Najem noted.
Measures against Discover-Tech
Discover-Tech is now being frozen out of parts of the online ad market.
Google said in a statement that it had collaborated with Citizen Lab and Confiant's investigation and kicked Discover-Tech off its ad platforms "for systematically violating our policies."
IAB Europe, the European-level association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had been suspended from its list of globally approved vendors last week after an audit identified policy violations.
Likewise, Comcast ad tech subsidiary Beeswax removed Discover-Tech from its platform "following recent activity," Comcast said in a statement.
Advertising-driven surveillance is increasingly being seen as a national security threat. Earlier this year, the Pentagon said it had received reports that U.S. forces deployed to war zones had been targeted using location data harvested by ad tech firms and data brokers. Branches of the military have since disabled ad tracking on some devices.
1 p.m. recap: Lebanon's energy sector 'at the heart of Qatar’s priorities,' Rubio criticizes Lebanon's Israel boycott law