Israeli Ad Firm Uncovered in Massive Global Spy Operation Targeting Hundreds of Millions

An Israeli digital advertising agency, Discover-Tech, has been implicated in a widespread spy operation, utilizing a network of online advertisements to track internet users and compromise their devices, according to research groups. Reports from Canada's Citizen Lab and the US advertising security firm Confiant reveal that Discover-Tech's services provided access to advertising platforms operated by major companies like Google, Comcast, and Russia's Yandex. This access was granted to Candiru, an Israeli spyware company previously blacklisted by the US government, as well as other Israeli surveillance entities.

Discover-Tech's online advertisements, often disguised as promotions for common products such as phones or earbuds, reached an extensive network of over 120,000 websites and 75,000 applications through various partnerships, Citizen Lab reported. Individuals visiting these sites or using these apps encountered malicious ads that enabled Discover-Tech to identify and track them. In some instances, the agency attempted to extract phone numbers from smartphone users. The spying mechanism was so effective that the ads only needed to load on a website for the surveillance to commence.

Some of these ads were reportedly used to facilitate the installation of spyware from Candiru onto users' devices. However, Confiant noted that the ads linked to Candiru represented only a portion of Discover-Tech's total ad volume. Jerome Dangu, co-founder of Confiant, stated that Discover-Tech was distributing at least 10 million ads daily worldwide. He further explained that data-sharing arrangements, known as cookie matching, allowed the company to track individuals even beyond the direct reach of its advertisements, suggesting that "very likely hundreds of millions of people would have been touched by Discover-Tech."

Citizen Lab detailed that a sophisticated form of Candiru spyware, deployed through Discover-Tech's ads, was used to compromise 45 Windows devices belonging to Qatar's Al Jazeera between 2024 and 2025. This finding was corroborated by Al Jazeera's sharing of its network logs with Citizen Lab. Al Jazeera issued a statement condemning the spyware attacks against its staff and affirming its commitment to protecting employees and systems, demanding accountability for those responsible.

Mr. Dangu indicated that the malicious ads were displayed across "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court. He also highlighted that certain regions, such as the Palestinian territories, were heavily saturated with Discover-Tech's advertisements. "You go to almost any site in Palestine – any site – you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country," he remarked.

Further evidence from Citizen Lab indicated that these malicious ads were served to individuals within organizations such as the UN, Nato, the European Commission, and over a dozen national governments. The ads also appeared on networks of technology companies like Nvidia and Sandisk, as well as media organizations in Mexico, Israel, and Europe. In response to these revelations, Discover-Tech is facing repercussions, including being excluded from significant parts of the online advertising market. Google announced its collaboration with Citizen Lab and Confiant's investigation, leading to Discover-Tech's removal from its ad platforms for policy violations. IAB Europe, the European association for the digital marketing and advertising sector, confirmed Discover-Tech's suspension from its globally approved entities list following an audit that identified policy breaches.