Discover-Tech used web ads for vast surveillance operation, researchers say

An Israeli digital advertising firm conducted a sweeping surveillance campaign against hundreds of millions of internet users by weaponising ordinary web ads to track people and compromise devices, according to cybersecurity researchers.

Findings published by the Canadian watchdog Citizen Lab and the American ad-security firm Confiant revealed that the company, Discover-Tech, enabled Israeli surveillance operators to infiltrate mainstream advertising systems operated by firms such as Google, Comcast and Russia's Yandex. Among the clients leveraging this network was Candiru, an Israeli spyware vendor placed on a blacklist by the United States government.

Discover-Tech disguised its operations behind routine promotions for everyday consumer electronics like headphones and mobile devices. These notices appeared across roughly 120,000 websites and 75,000 mobile applications through extensive industry distribution networks. Internet users did not even need to interact with the material to become targets; researchers discovered that simply rendering the advertisement on a page was enough to trigger tracking, gather device details and occasionally attempt to harvest smartphone telephone numbers.

In specific cases, the network served as an infection vector to secretly deliver Candiru spyware directly onto targeted computers. Citizen Lab documented that 45 Windows systems belonging to the Qatari news broadcaster Al Jazeera were penetrated between 2024 and 2025 using these ad-based exploits, a finding corroborated by an analysis of the network records provided by the media organisation. Al Jazeera denounced the cyber assaults on its staff and called for the perpetrators to face accountability.

The broader surveillance operation extended far beyond specific hack attempts. Confiant estimated that Discover-Tech distributed at least 10 million ad impressions daily worldwide. Through data-linking techniques known as cookie matching, the agency tracked user behavior well beyond the web pages hosting its actual content, likely touching hundreds of millions of internet users globally.

The tracking notices reached users inside high-security and diplomatic environments. Confiant co-founder Jerome Dangu stated that the firm's ads appeared within networks linked to the Pentagon, the International Criminal Court and the International Atomic Energy Agency. Citizen Lab similarly documented exposure within NATO, the United Nations, the European Commission, more than a dozen sovereign governments and major tech corporations including Nvidia and Sandisk.

Dangu also highlighted intense regional concentration in the Palestinian territories, observing that the firm's ads saturated nearly every domestic website, granting the entity comprehensive insight into the broader population's online activity.

Following the investigation, major digital advertising networks have begun removing the firm. Google announced it worked alongside the researchers and banned Discover-Tech from its ad ecosystem due to persistent policy infractions. Similarly, European digital advertising trade body IAB Europe suspended the company from its approved register after an internal review uncovered multiple regulatory violations.