The ads looked like nothing. A phone here, a pair of earpods there — the same forgettable rectangles you scroll past a hundred times a day. But according to two research groups, those ordinary ads were the front door of one of the largest spy operations ever uncovered.
The company behind them is Discover-Tech, an Israeli digital advertising agency founded in 2020. Separate reports released Thursday by Citizen Lab, the Canadian cyber watchdog at the University of Toronto, and Confiant, a New York advertising-security firm, describe how its ad network was bent into an instrument of mass surveillance.
The mechanism was brutally simple. Discover-Tech’s ads reached more than 120,000 websites and 75,000 apps through its partnerships, Citizen Lab said — and an ad only had to load on a page for the spying to begin. No click required. Visitors could be identified and tracked, and in some cases phone numbers were pulled straight off smartphones.
Who was buying this access? The researchers say Discover-Tech’s services gave Candiru — the Israeli spyware maker blacklisted by the US government — along with other Israeli surveillance firms, a doorway into advertising platforms run by Google, Comcast, and even Russia’s Yandex. Some of the ads were used to plant Candiru’s spyware directly onto victims’ devices, though Confiant notes those were a tiny fraction of Discover-Tech’s overall volume.
The scale is what staggers. Confiant cofounder Jerome Dangu said the company was pushing out at least 10 million ads a day around the world, and data-sharing deals known as “cookie matching” let it follow people even beyond the reach of its own ads. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.
There is already a confirmed victim list. Citizen Lab found that a powerful form of Candiru spyware, delivered through Discover-Tech’s ads, was used to compromise 45 Windows devices at Qatar’s Al Jazeera between 2024 and 2025 — confirmed because the broadcaster shared its network logs with the researchers.
“The way online advertising works today is a systemic security threat,” Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters. “For states, the private sector, civil society and everyone else alike.”
That is the part that should worry ordinary readers most. This was not an operation aimed only at activists or officials. It rode on the same plumbing that serves ads to everyone — the real-time bidding systems, the trackers, the data brokers — which means the infrastructure of the everyday internet doubled as the infrastructure of espionage. If an ad agency can quietly become an intelligence cutout, the question is not just who was watched, but how many other pipelines are running right now, unnoticed.
Discover-Tech has not responded. The researchers said messages left through its contact form went unanswered, as did a LinkedIn message and emails to its chief executive, Dekel Boni.
