{"id":2732,"date":"2026-10-15T16:04:30","date_gmt":"2026-10-15T11:04:30","guid":{"rendered":"https:\/\/ipp-news.com\/?p=2732"},"modified":"2026-10-15T16:04:30","modified_gmt":"2026-10-15T11:04:30","slug":"israeli-firm-used-online-ads-to-run-vast-spy-operation-researchers-say","status":"publish","type":"post","link":"https:\/\/ipp-news.com\/?p=2732","title":{"rendered":"Israeli firm used online ads to run vast spy operation, researchers say"},"content":{"rendered":"
\n

Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads that it used to \u200btrack targets and help hack their devices, two research groups said on Thursday.<\/strong><\/p>\n

Its services gave Israel\u2019s Candiru \u2014 a spyware company blacklisted by the US government \u2014 as well as \u200cother Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia\u2019s Yandex and others, according to separate reports from Canadian cyber watchdog group Citizen Lab and New York advertising security firm Confiant.<\/p>\n

The reports show how the online advertising business, long a subject of privacy concerns, can also serve as a channel for sweeping espionage campaigns.<\/p>\n

\u201cThe way online advertising works today is a systemic security threat,\u201d Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters<\/em>. \u201cFor states, the private sector, \u200bcivil society and everyone else alike.\u201d<\/p>\n

Discover-Tech\u2019s online ads \u2014 often for ordinary products such as phones or earpods \u2014 reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen \u200bLab said.<\/p>\n

Users who visited sites or used apps with the malicious ads could be identified and tracked by Discover-Tech, which would sometimes also try to \u2060extract phone numbers from some smartphone users, the researchers said. Ads only needed to load on a website for the spying to occur.<\/p>\n

Some ads would be used to help plant spyware from Candiru \u200bon users\u2019 devices, both research groups said, though Confiant said that ads it tied to Candiru were a tiny fraction of Discover-Tech\u2019s overall volume.<\/p>\n

<\/a>Malicious ads shown in hundreds of sensitive networks<\/h3>\n

Confiant cofounder Jerome Dangu \u200bsaid Discover-Tech was pumping out at least 10 million ads per day all around the world and that data-sharing arrangements \u2014 called cookie matching \u2014 allowed it to track people even beyond the reach of its advertisements.<\/p>\n

\u201cVery likely hundreds of millions of people would have been touched by Discover-Tech,\u201d Dangu said.<\/p>\n

Discover-Tech, which was founded in 2020, did not return messages left via its contact form. A LinkedIn message and emails sent to its chief executive, Dekel Boni, were not returned.<\/p>\n

Reuters\u2019 \u200battempts to reach Candiru\u2019s owners were not successful. The US Commerce Department blacklisted Candiru in 2021 for allegedly supplying spyware that was used to maliciously target government officials, journalists, activists and academics.<\/p>\n

Citizen Lab said \u200ba powerful form of Candiru spyware delivered through Discover-Tech\u2019s ads had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, something it said it was able to confirm because \u200cthe media \u2060group had shared its network logs with the group. Al Jazeera did not return messages seeking comment.<\/p>\n

Dangu of Confiant said that the malicious ads had been shown to users in \u201chundreds of networks in sensitive categories,\u201d including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court. He also said that some regions, like the Palestinian territories, were particularly saturated by the Israeli firm\u2019s ads.<\/p>\n

\u201cYou go to almost any site in Palestine \u2014 any site \u2014 you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,\u201d he said.<\/p>\n

Citizen Lab also said it had similar \u200bevidence showing the malicious ads were shown to people \u200bin the United Nations, NATO, the European \u2060Commission, and more than a dozen other national governments. Other networks the ads appeared in included chip-related firms such as Nvidia, SanDisk, Broadcom, and Micron, as well as several media organisations in Mexico, Israel, and Europe that were not identified.<\/p>\n

In addition to identifying Candiru and a couple of other surveillance vendors, \u200bCitizen Lab said it was able to glean some details about where Discover-Tech\u2019s users might be based because the firm inadvertently exposed its authentication \u200blogs to the internet, \u2060showing people logging in from internet protocol addresses in Israel, Europe, and the Gulf.<\/p>\n

<\/a>Measures against Discover-Tech taken<\/h3>\n

Discover-Tech is now being frozen out of parts of the online ad market.<\/p>\n

Google said in a statement that it had collaborated with Citizen Lab and Confiant\u2019s investigation and kicked Discover-Tech off its ad platforms \u201cfor systematically violating our policies.\u201d<\/p>\n

IAB Europe, the European-level association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had \u2060been suspended from \u200bits list of globally approved vendors last week after an audit identified policy violations.<\/p>\n

Comcast ad tech subsidiary Beeswax removed Discover-Tech \u200bfrom its platform \u201cfollowing recent activity,\u201d Comcast said in a statement. Yandex did not return Reuters messages seeking comment.<\/p>\n

Advertising-driven surveillance is increasingly being seen as a national security threat. Earlier this year, the Pentagon said it had received reports that US forces deployed \u200bto war zones had been targeted using location data harvested by ad tech firms and data brokers. Branches of the military have since disabled ad tracking on some devices.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Israeli digital advertising agency Discover-Tech spied on internet users through a sprawling network of online ads that it used to \u200btrack targets and help hack their devices, two research groups said on Thursday. Its services gave Israel\u2019s Candiru \u2014 a spyware company blacklisted by the US government \u2014 as well as \u200cother Israeli surveillance firms access to advertising platforms run by Google, Comcast, Russia\u2019s Yandex and others, according to separate reports from Canadian cyber watchdog group Citizen Lab and New York advertising security firm Confiant. The reports show how the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-2732","post","type-post","status-publish","format-standard","hentry","category-english"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/2732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2732"}],"version-history":[{"count":0,"href":"https:\/\/ipp-news.com\/index.php?rest_route=\/wp\/v2\/posts\/2732\/revisions"}],"wp:attachment":[{"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipp-news.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}