Israeli firm used online ads to run vast spy operation, researchers say
- Discover-Tech used ordinary-looking online ads on 120K+ sites and 75K apps to secretly track users, steal phone numbers, and even plant Candiru spyware on devices.
- Candiru — already blacklisted by the US Commerce Department — allegedly used this ad network to hack 45 Windows devices at Al Jazeera between 2024 and 2025.
- The ads reached sensitive networks: the Pentagon, IAEA, ICC, UN, NATO, European Commission, plus chip giants like Nvidia and Broadcom, and saturated the Palestinian territories.
- Google, Comcast's Beeswax, and IAB Europe have already kicked Discover-Tech to the curb after the researchers' reports surfaced.
- Cookie matching let the firm track users even beyond its own ads, impacting 'very likely hundreds of millions of people,' per Confiant.
Brief Summary
In a stunning piece of industrial espionage disguised as digital advertising, Israeli firm Discover-Tech reportedly weaponized the internet's most annoying feature — banner ads — to run a global tracking and hacking operation. Researchers from Citizen Lab and Confiant found the firm's innocuous-looking ads for phones and earpods served as a Trojan horse, identifying users, swiping phone numbers, and even delivering Candiru's infamous spyware to targets' devices. The ads blanketed everything from the Pentagon and NATO networks to the International Criminal Court, with a particular obsession on flooding websites in the Palestinian territories. It's a grim, cynical reminder that the same ad tech that follows you around to sell sneakers can just as easily be hijacked to feed your digital life to state-sponsored assassins. While the company is now being frozen out of major ad platforms, the damage is done — and the systemic vulnerability remains wide open for the next cyber-mercenary with a marketing budget.
Why This Matters
This story is personal because your data isn’t just being collected to sell you junk — it’s now a battleground for espionage. The same cookie-matching and ad-loading infrastructure that tracks your preferences for pizza delivery can be quietly repurposed to deliver malware or map your every click for a foreign government or hostile actor. If you visit any niche website or download a free app, you could be walking into a surveillance trap set by a private spy firm with no oversight and a direct line to blacklisted software vendors. This isn't hypothetical: the ads reached Pentagon, UN, and NATO networks, proving that the guardians of state secrets aren’t immune, so your personal phone and browser are trivial collateral. The report signals that the ad tech industry’s privacy problem is no longer just about creepy retargeting — it’s a national security risk that could justify sweeping regulation. For the average reader, it means online ads are now a literal minefield: an unseen 'yes' to a cookie request could be the equivalent of leaving your digital front door unlocked for mercenaries.