Israeli firm ran global spy operation through online ads – investigation

Israeli ad tech company Discover-Tech exploited online advertising infrastructure to track targets and help deliver spyware to dozens of devices belonging to Al Jazeera staff and members of other entities, according to investigations by the Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.

The researchers said Discover-Tech used a sprawling network of online ads to identify potential targets, monitor their activity and facilitate the compromise of their devices.

“The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting,” Confiant said in its findings.

Devices belonging to staff at the international news network Al Jazeera were among those infected through malicious ad placements, which operated silently, without visible pop-ups or suspicious links. The Qatar-based media network condemned “the spyware attacks targeting a number of its staff,” describing them as an “assault on press freedom,” and called for those responsible to be held accountable.

The investigation also linked the malicious activity to Israeli spyware developer Candiru, which has been blacklisted by the US and rebranded as Integrity Labs, and Israeli surveillance technology provider Intelos. The companies allegedly exploited ad inventory on major platforms, including Google, Russia’s Yandex and US ad tech platform Beeswax to track targets and compromise consumer devices.

Discover-Tech used a system called Controlium to turn routine ad auctions into a surveillance tool. Over four months, it served ads across nearly 200,000 websites and mobile apps on Android and iOS devices in dozens of countries. According to Confiant, the company generated about 10 million ad impressions daily, harvesting device fingerprints, IP addresses, authentication tokens, cookies and other personal data, including without consent where required under EU privacy rules. Citizen Lab also identified a group linked to Discover-Tech, dubbed Dark Cartographer, which allegedly exploited vulnerabilities at mobile carriers and matched advertising IDs with phone numbers to track subscribers on a large scale.

Geographic data revealed sharp spikes in traffic that researchers said pointed to targeted intelligence-gathering operations rather than routine commercial advertising. Palestine was the most heavily targeted territory, where Discover-Tech accounted for nearly 2% of all digital ad impressions, peaking at around 10% on April 7. The activity also reached sensitive networks, including the Armenian prime minister’s office, international organizations, courts, universities and defense institutions. Investigators detected targeted connections to Candiru servers in nine countries, with Belgium accounting for 56% of recorded activity, followed by the UAE, Saudi Arabia, Bahrain, Mexico and Spain.

Confiant described the campaign as highly sophisticated, citing its anti-interception measures and precise targeting capabilities. Citizen Lab said the findings provided the first public technical evidence that spyware could be delivered through online ads without users clicking on anything, a technique researchers dubbed “AdFection.”