Citizen Lab and Confiant said on Thursday that Israeli advertising firm Discover-Tech used online ads to track users and help deliver Candiru spyware to selected devices.
Citizen Lab identified attacks against at least 45 devices at Qatari broadcaster Al Jazeera during 2024 and 2025. It confirmed the infections through network logs the broadcaster supplied.
Google said it had removed Discover-Tech from its advertising platforms for policy violations after collaborating with the researchers. Comcast’s advertising technology subsidiary, Beeswax, also removed the company from its platform.
Interactive Advertising Bureau Europe (IAB Europe) suspended Discover-Tech from its approved vendor list after an audit identified policy breaches.
Al Jazeera condemned the attacks against its staff and announced steps to protect employees and systems.
Researchers described two uses of the advertising network: identifying and tracking internet users, and helping spyware operators infect selected devices. Ordinary-looking ads for products such as phones and earbuds served as the delivery channel. Users did not need to click an advertisement.
The researchers explained that simply loading an affected ad could trigger tracking or an attempted infection. Citizen Lab calls the spyware delivery technique AdFection, a form of zero-click attack.
The group linked Discover-Tech’s services to Candiru and other surveillance vendors accessing advertising systems operated by Google, Comcast and Yandex.
According to Citizen Lab, Discover-Tech advertisements reached more than 120,000 websites and tens of thousands of apps. Confiant cofounder Jerome Dangu estimated that the firm served around 10 million ad impressions daily.
He described data-sharing arrangements known as cookie matching that enabled tracking beyond the company’s own advertisements. Dangu estimated that hundreds of millions of people may have encountered its operations.
Confiant linked only a tiny fraction of Discover-Tech’s overall ad volume to Candiru.
Dangu identified ad exposure on networks associated with the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab found impressions on United Nations, North Atlantic Treaty Organisation (NATO) and European Commission networks.
Pakistan appeared on Citizen Lab’s list of countries where government-operated networks received the advertisements.
Citizen Lab cautioned that an ad appearing on a network does not establish a spyware infection. It called for further investigation into whether devices on those networks had been compromised.
Read: Darksword iPhone Spyware Campaign Targets Apple Devices
Its researchers identified attempts to link advertising identifiers to phone numbers, along with broader efforts to identify users. The group said exposed authentication logs separately showed Discover-Tech account access from internet protocol addresses in Israel, Europe and the Gulf.
“The way online advertising works today is a systemic security threat,” said Wolfie Christl, a senior researcher at Citizen Lab.
Discover-Tech and chief executive Dekel Boni did not respond to Reuters’ requests for comment. Its attempts to reach Candiru’s owners were unsuccessful, while Yandex did not answer its enquiries.
In 2021, the US Commerce Department blacklisted Candiru over allegations that its spyware enabled malicious targeting of officials, journalists, activists and academics.
