1 hour ago
Online advertisements for everyday products such as phones and earbuds may have been used to track internet users and help install spyware on their devices, according to two investigations into an Israeli digital advertising company.
Discover-Tech allegedly built a sprawling advertising network that reached more than 120,000 websites and 75,000 apps, allowing it to track users and, in some cases, help surveillance firms target their devices, researchers said on Thursday.
The findings, published separately by Canadian cyber watchdog Citizen Lab and New York-based advertising security firm Confiant, expose how the digital advertising industry can be exploited for purposes far removed from selling products.
The revelations also raise concerns for internet users in India, where millions rely on advertising-supported websites and mobile apps for news, shopping and everyday services. However, the investigations do not establish that Indian users or government networks were specifically targeted by Discover-Tech.
HOW THE ADVERTISING NETWORK WORKED
Online advertising relies on technology that helps companies identify users, measure their behaviour and deliver targeted promotions. Researchers said Discover-Tech allegedly exploited this infrastructure to track people across websites and apps, with some advertisements reportedly helping to deliver spyware.
Users did not necessarily have to click on an advertisement for tracking to begin. According to the researchers, the ads could collect information simply by loading on a webpage or within an app. Discover-Tech also sometimes attempted to extract phone numbers from smartphone users, they said.
The company's reach extended beyond the websites and apps carrying its advertisements. Through a process known as cookie matching, advertising companies can share or match identifiers to recognise users across different platforms.
Jerome Dangu, co-founder of Confiant, said Discover-Tech was distributing at least 10 million advertisements a day worldwide. He estimated that hundreds of millions of people could have encountered its ads.
"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.
Wolfie Christl, a senior researcher at Citizen Lab, said the findings pointed to a wider vulnerability in the advertising ecosystem.
"The way online advertising works today is a systemic security threat," Christl told Reuters. "For states, the private sector, civil society and everyone else alike."
SPYWARE LINKS AND THE AL JAZEERA CASE
The investigations linked some of Discover-Tech's advertisements to Candiru, an Israeli spyware company that was blacklisted by the US government in 2021 over allegations that it supplied software used to target government officials, journalists, activists and academics.
Spyware can secretly access information on a device, potentially exposing private communications and other sensitive data. Researchers said some advertisements distributed through Discover-Tech were used to help install Candiru's spyware on targeted devices.
Confiant stressed that the advertisements it linked to Candiru represented only a tiny fraction of Discover-Tech's overall advertising volume.
Citizen Lab said it had confirmed that a powerful form of Candiru spyware, delivered through Discover-Tech's ads, was used to compromise 45 Windows devices at Qatari broadcaster Al Jazeera between 2024 and 2025. The group said it established the link after the broadcaster shared its network logs.
In a statement, Al Jazeera said it "condemns the spyware attacks targeting a number of its staff" and that it was taking steps to protect its employees and its systems. "Those responsible must be held accountable," it said.
ADS APPEARED ON SENSITIVE NETWORKS
The reach of Discover-Tech's advertising network reportedly extended into some of the world's most sensitive institutions.
Dangu said the ads had appeared in "hundreds of networks in sensitive categories," including the Pentagon, the Atomic Energy Agency and the Criminal Court.
Citizen Lab reported similar evidence involving networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments.
The ads also appeared on networks linked to semiconductor companies Nvidia, SanDisk, Broadcom and Micron, as well as media organisations in Mexico, Israel and Europe. The researchers did not name the media outlets.
The Palestinian territories appeared to have been particularly saturated with the company's advertisements, Dangu said.
"You go to almost any site in Palestine -- any site -- you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country," he said.
Citizen Lab also found that Discover-Tech had inadvertently exposed authentication logs online. The records contained internet protocol addresses indicating that people had logged into the company's systems from Israel, Europe and the Gulf, offering clues about the possible locations of its users.
GOOGLE, AD INDUSTRY MOVE AGAINST FIRM
Discover-Tech has since been excluded from parts of the online advertising market.
Google said it had worked with Citizen Lab and Confiant on the investigation and removed the company from its advertising platforms "for systematically violating our policies."
IAB Europe, which represents the digital advertising and marketing industry, said it had suspended Discover-Tech from its list of globally approved vendors the previous week after an audit found policy violations.
Comcast said its advertising technology subsidiary, Beeswax, had removed Discover-Tech from its platform "following recent activity." Russia's Yandex did not respond to Reuters' request for comment.
Discover-Tech, founded in 2020, did not respond to messages sent through its contact form. Its chief executive, Dekel Boni, also did not respond to emails or a LinkedIn message. Reuters was unable to reach Candiru's owners for comment.
The findings add to growing concerns that data collected through the advertising industry can be exploited for surveillance, including in national security contexts.
Earlier this year, the Pentagon said it had received reports that US forces deployed in war zones had been targeted using location data harvested by advertising technology companies and data brokers. Some branches of the US military subsequently disabled ad tracking on certain devices.
- Ends
