Israeli Advertising Firm Linked to Global Spyware Delivery via Online Ads

This incident highlights the vulnerabilities in digital advertising ecosystems that can be exploited for commercial surveillance.

• Investigations revealed that Israeli advertising firm Discover-Tech facilitated spyware delivery through online ads, impacting users globally.
• Ads from Discover-Tech appeared on over 120,000 websites and 70,000 mobile apps, reaching nearly four billion bidding records.
• Google and IAB Europe took action against Discover-Tech, removing it from their platforms due to policy violations.

• Commercial digital advertising relies on real-time bidding, often sharing sensitive user data, making it a target for surveillance operations.
• Israeli firms like Candiru have a history of targeting journalists and activists, raising concerns about press freedom and privacy.
• Discover-Tech's operations were masked as legitimate ad services, complicating the detection of malicious activities within the ad ecosystem.

The recent revelations about Discover-Tech's involvement in spyware delivery underscore a troubling trend in the digital advertising landscape. The firm, which emerged in 2020, positioned itself as a legitimate intermediary in the ad-tech space, utilizing its Controlium platform to enable precise targeting and de-anonymization of users. This allowed for the exploitation of real-time bidding processes, where device identifiers, IP addresses, and network details are routinely exchanged among advertisers.

Between March and June 2026, Discover-Tech's ads reached an astonishing 200,000 unique sites and apps, distributing at least 10 million ads daily. This scale of operation facilitated the tracking and profiling of millions of devices, leading to confirmed spyware infections on 45 Windows devices at Al Jazeera between 2024 and 2025. The technique employed, known as AdFection, enabled zero-click malware delivery, meaning users could be infected simply by viewing an ad without any interaction.

The implications of this are profound. As digital advertising continues to grow, so does the potential for misuse by malicious actors. The intersection of advertising technology and surveillance raises critical questions about user consent, privacy, and the ethical responsibilities of tech companies. With Discover-Tech's ads appearing on sensitive networks, including those of NATO and the United Nations, the risk of broader surveillance operations targeting journalists, activists, and government entities becomes increasingly concerning.

In response to the findings, Google removed Discover-Tech from its advertising platforms, and IAB Europe suspended the firm from its approved vendor list. However, the lack of immediate regulatory actions or market shifts beyond these platform enforcements suggests a gap in accountability within the ad-tech industry. The ongoing investigations by Citizen Lab and Confiant indicate that this issue may not be isolated, and further scrutiny of the ad ecosystem is likely necessary to prevent similar incidents in the future.

• Journalists and media organizations: Increased risk of surveillance and compromised communications.
• Activists and NGOs: Heightened vulnerability to tracking and potential harassment.
• General consumers: Potential exposure to spyware through everyday apps and websites.
• Digital advertisers: Increased scrutiny and potential regulatory challenges in the ad-tech space.

• Regulatory responses: Monitor for any new regulations or guidelines aimed at enhancing privacy and security in digital advertising.
• Industry audits: Watch for increased audits and compliance checks within the ad-tech industry to prevent similar abuses.
• Technological advancements: Keep an eye on developments in ad-tech that prioritize user privacy and security, potentially reshaping the landscape.