Israeli Ad Firm Uncovered for Global Surveillance via Online Advertising

The intersection of digital advertising and surveillance raises significant concerns about privacy and data security in the online ecosystem.

• Investigations revealed that Israeli ad firm Discover-Tech conducted a global surveillance operation using online ads to track users and deliver spyware.
• Over 120,000 websites and 75,000 apps were involved, with at least 10 million ads served daily, facilitating data harvesting and spyware delivery.
• Major ad platforms like Google and Comcast severed ties with Discover-Tech following the revelations, prompting scrutiny of ad-tech practices.

• Discover-Tech's Controlium system transformed routine ad auctions into tools for surveillance, enabling extensive tracking of users.
• Candiru spyware, previously blacklisted by the US, was delivered through these ads, targeting sensitive organizations like Al Jazeera.
• The ad-tech ecosystem has increasingly been linked to state-sponsored cyber operations, raising alarms about the security of digital advertising infrastructures.

On October 15, 2026, Citizen Lab and Confiant published findings that exposed the extensive surveillance operation orchestrated by Discover-Tech, an Israeli digital advertising agency. This operation utilized a sophisticated system known as Controlium, which turned standard ad auctions into mechanisms for tracking and data collection. Between March and June 2026, Discover-Tech served a staggering minimum of 10 million ads daily across nearly 200,000 websites and apps. This massive scale allowed the firm to harvest user fingerprints, cookies, and tokens, effectively creating detailed profiles of individuals without their consent.

The implications of this operation are profound. Discover-Tech's ads not only promoted everyday products but also facilitated the delivery of Candiru spyware, which has been linked to breaches at Al Jazeera and other sensitive networks. The targeted regions included Palestine and various international organizations, including UN and NATO networks, indicating a strategic focus on high-value targets. The operation's reach into the digital spaces of the Gulf, particularly the UAE, raises concerns about the potential tracking of residents and organizations in Dubai and surrounding areas.

In response to the revelations, major ad platforms like Google acted swiftly to terminate Discover-Tech's access, while IAB Europe suspended its membership. This reaction underscores a growing awareness and concern regarding the vulnerabilities inherent in the ad-tech ecosystem. The incident has sparked calls for regulatory reforms aimed at addressing systemic security risks associated with online advertising practices. As scrutiny intensifies, the ad-tech industry may face significant changes in how data is collected and used, with potential implications for advertisers, consumers, and regulatory bodies alike.

• Digital advertisers: Increased scrutiny may lead to stricter regulations and changes in how ads are served.
• Consumers: Heightened awareness of privacy risks could shift user behavior and demand for more secure online experiences.
• Media organizations: Targeted attacks on press freedom may lead to calls for stronger protections against surveillance.

• Regulatory changes: Watch for new legislation aimed at enhancing data privacy and security in digital advertising.
• Market shifts: Monitor how ad platforms adjust their policies and practices in response to increased scrutiny.
• Technological innovations: Keep an eye on emerging technologies that prioritize user privacy and data protection in advertising.