Citizen Lab and Confiant investigations link Israeli advertising company Discover-Tech to spyware operations targeting internet users, with sensitive networks allegedly exposed
An investigation by Canadian cybersecurity research group Citizen Lab and New York-based advertising security firm Confiant has raised serious concerns about the potential misuse of online advertising technology for surveillance and spyware delivery, with researchers alleging that an Israeli digital advertising company helped connect spyware operators to advertising platforms used across the internet. According to findings reported by Reuters on Thursday, October 15, 2026, the company, Discover-Tech, allegedly helped Israeli spyware developer Candiru and other surveillance operators gain access to advertising systems associated with major technology companies, including Google, Comcast and Russia’s Yandex. The investigations highlight how digital advertising infrastructure, which is designed to deliver commercial messages to users, can potentially be exploited to track individuals, collect sensitive information and expose devices to sophisticated cyber threats. Researchers said the activity reached far beyond ordinary consumers, with advertisements reportedly appearing on networks associated with government agencies, international organisations, technology companies and news organisations.
The findings have intensified concerns about the security implications of the online advertising ecosystem, particularly the complex network of advertising exchanges, data brokers and technology providers that enables advertisements to be delivered across millions of websites and applications. While digital advertising is generally associated with commercial targeting and consumer analytics, the investigations suggest that the same infrastructure can provide opportunities for surveillance when it is used by actors seeking information about particular individuals or populations. According to the researchers, Discover-Tech distributed advertisements promoting ordinary products, including mobile phones and wireless earbuds, while partnerships with other advertising companies enabled those advertisements to reach more than 120,000 websites and approximately 75,000 applications. The advertisements appeared to be part of routine online marketing activity, but researchers said the associated technology could also be used to identify and monitor people visiting websites or using applications where the advertisements were displayed.
Citizen Lab senior researcher Wolfie Christl told Reuters that the way online advertising currently operates represents a deliberately structured security risk. He warned that the potential consequences extend across governments, private businesses, civil society organisations and ordinary internet users. His assessment reflects a growing concern among cybersecurity specialists that the extensive collection and exchange of advertising data can create vulnerabilities far beyond those originally intended by the companies operating these systems. Information gathered through advertising technologies may reveal a person’s browsing activity, approximate location, device characteristics and other identifying details. When these capabilities are combined with targeted surveillance operations, the resulting information can potentially be used to identify people of interest and support more intrusive forms of monitoring.
According to the research findings, Discover-Tech was allegedly able to track users who encountered advertisements connected to its network. In some cases, the company reportedly attempted to obtain mobile phone numbers associated with smartphone users. Researchers said that, under certain circumstances, a person did not necessarily need to click an advertisement for the associated tracking mechanism to operate. The advertisement’s appearance or loading on a website could be sufficient to trigger certain forms of data collection, depending on the technology involved. This raises questions about how effectively users can protect themselves when tracking takes place through advertising systems embedded in websites and applications that they use during their everyday activities.
The investigations also identified links between some advertisements and spyware developed by Candiru, an Israeli surveillance technology company previously placed on a United States government blacklist. Researchers said certain advertising mechanisms helped facilitate the delivery of spyware to users’ devices. Confiant, however, stressed that advertisements associated with Candiru represented only a small proportion of Discover-Tech’s overall advertising activity. That distinction is significant because it suggests that the alleged spyware-related activity was part of a much larger advertising operation rather than a description of every advertisement distributed through the company’s network.
Confiant co-founder Jerome Dangu said Discover-Tech delivered at least 10 million advertisements worldwide each day. He explained that the company used a data-sharing technique known as cookie matching, which allows different advertising systems to match identifiers associated with the same user or device. Such techniques are commonly used in digital advertising to coordinate audience targeting across platforms. However, researchers said these mechanisms could also allow Discover-Tech to track people beyond the immediate boundaries of its own advertising network. Dangu estimated that the company’s tracking activities may have affected millions of people worldwide, although the precise number of individuals whose information was collected or whose devices were exposed remains uncertain.
One of the most concerning aspects of the investigation involves the alleged exposure of sensitive institutional networks to advertisements connected to the surveillance operation. According to Confiant, the advertisements appeared on networks associated with the United States Department of Defense, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab separately reported that advertisements were also displayed to individuals associated with the United Nations, NATO, the European Commission and government-related organisations in more than a dozen countries. The presence of advertisements on such networks does not by itself establish that every institution was compromised or that every person who encountered an advertisement was infected with spyware. Nevertheless, the findings raise questions about whether advertising-based tracking could create intelligence opportunities involving officials, researchers, journalists and other people working in sensitive environments.
The research also identified advertisements appearing on networks associated with major semiconductor and technology companies, including Nvidia, SanDisk, Broadcom and Micron, as well as several media organisations in Mexico, Israel and Europe. These findings illustrate the breadth of the advertising ecosystem and the difficulty of separating ordinary commercial activity from potential surveillance risks. Organisations may have limited visibility into the advertising systems operating on their employees’ devices, particularly when staff members browse websites or use applications outside tightly controlled corporate environments. If malicious advertising is capable of collecting identifying information or facilitating spyware delivery, even organisations with sophisticated cybersecurity programmes may face risks through devices that are not directly connected to their internal systems.
Citizen Lab also reported that it identified information about the locations of users associated with Discover-Tech’s advertising activity. According to the researchers, some users appeared to connect from internet protocol addresses associated with Israel, Europe and the Gulf region. The researchers said they were able to examine this information after Discover-Tech inadvertently left authentication logs accessible on the internet. Exposed authentication records can provide valuable information about account access and system activity, but they can also create additional security risks when they reveal details that should remain private. The reported exposure gave researchers an opportunity to examine aspects of the company’s operations and identify possible connections between its advertising infrastructure and surveillance-related activity.
The investigation also drew attention to an alleged spyware operation involving Al Jazeera, the Qatar-based international broadcaster. Citizen Lab said that between 2024 and 2025, powerful spyware developed by Candiru was used in an attempt to infiltrate 45 Windows devices belonging to the broadcaster through advertisements delivered via Discover-Tech. According to Citizen Lab, researchers were able to confirm the activity after Al Jazeera shared network logs for analysis. The findings are particularly significant because journalists and media organisations can be attractive targets for surveillance due to their work with confidential sources, sensitive documents and information about political and security developments. However, the reported findings should be understood within the scope of Citizen Lab’s investigation and do not establish that every device or employee associated with the broadcaster was compromised.
Candiru has previously faced restrictions from the United States government. In 2021, the US Department of Commerce placed the company on its Entity List amid allegations that its spyware had been supplied for use against government officials, journalists, activists and academics in several countries. Companies added to the list face restrictions on certain exports and commercial transactions involving US-controlled goods and technology. The designation reflected broader concerns about the international spyware industry, in which commercially developed surveillance tools can be used against individuals who are not accused of criminal activity. The latest investigation raises further questions about how surveillance companies may use third-party advertising infrastructure to identify potential targets or facilitate access to devices.
Researchers also highlighted the alleged concentration of Discover-Tech advertisements in Palestinian territories. Dangu said the company’s advertisements were widespread across Palestinian websites, potentially creating opportunities to observe digital activity across a substantial portion of the local online environment. Such coverage could allow an operator to collect information about browsing patterns, device identifiers and other data associated with people accessing websites in the region. If combined with other datasets, this information could potentially support the identification of individuals or the mapping of digital activity within a particular population. The researchers’ findings raise particular concerns about privacy and surveillance in conflict-affected areas, where journalists, aid workers, activists and civilians may already face heightened security risks.
The reported reach of the advertising operation has also drawn attention to the relationship between commercial advertising companies and the wider intelligence and surveillance industry. Advertising technology often relies on a chain of intermediaries, including publishers, exchanges, data management services and companies that help match user identifiers across systems. Each participant may have access to different pieces of information, while the complete process can remain difficult for users and even some website operators to understand. This complexity can make it challenging to determine who is collecting data, how long it is retained, whether it is shared with third parties and whether it is being used for purposes beyond advertising. Researchers argue that these gaps in transparency can create opportunities for misuse, especially when companies with access to large advertising networks operate in ways that are difficult to audit independently.
Following the investigations, major advertising platforms began taking action against Discover-Tech. Google said it had cooperated with Citizen Lab and Confiant and confirmed that it had banned the company from its advertising platform for repeated violations of its advertising policies. The decision represents a significant commercial consequence for a company whose business depends on access to advertising infrastructure and partnerships. IAB Europe, an industry organisation representing the digital advertising sector, said Discover-Tech had been temporarily suspended from its global list of authorised sellers the previous week after an audit identified policy violations. Comcast-owned advertising technology company Beeswax also removed Discover-Tech from its platform following concerns about the company’s activities.
These actions indicate that the allegations have prompted responses from several parts of the advertising industry. However, removing a company from particular advertising platforms does not necessarily eliminate every copy of its technology, every existing data record or every possible connection to other service providers. Investigators and platform operators may still need to determine whether information collected through the system has been retained, transferred to other parties or used in additional surveillance activities. The extent of any continuing access, the full number of affected users and the precise role played by each organisation remain important questions.
Discover-Tech was founded in 2020. Reuters reported that it attempted to contact the company through the contact form on its website but received no response. The news agency also said that emails and LinkedIn messages sent to chief executive Dekel Boni went unanswered. Reuters reported that attempts to contact Candiru’s owners were also unsuccessful. The absence of responses means that the companies’ explanations of the allegations were not available in the report. The findings therefore remain based on the investigations and evidence described by Citizen Lab and Confiant, alongside the responses reported from advertising industry organisations.
The case has emerged as governments increasingly examine how commercial data collection can affect national security. Earlier in 2026, the Pentagon said it had identified cases in which US forces deployed in operational environments could be targeted using location data collected by advertising technology companies and data brokers. In response, branches of the US military began disabling advertising-tracking features on several devices. The concern is that information collected for commercial purposes may reveal the movements of military personnel, the locations of sensitive facilities or patterns of activity that could be exploited by hostile actors. Location information can be especially sensitive when combined with other details, including the timing of device activity and records from multiple data sources.
The potential security implications extend beyond military personnel. Government officials, diplomats, journalists, human rights defenders, researchers and business executives may all use the same advertising-supported websites and applications as ordinary consumers. If their devices are exposed to targeted advertising-based surveillance, information about their online behaviour could potentially be used to identify contacts, map routines or develop further targeting strategies. The risk is particularly difficult to manage when the initial point of exposure is an advertisement that appears to be legitimate and does not require the user to download a suspicious file or click an unfamiliar link.
Cybersecurity specialists have long warned that spyware can compromise confidential communications, access files and collect information from targeted devices, depending on the capabilities of the software and the vulnerabilities it exploits. Advertising-based delivery can complicate detection because the activity may occur within ordinary browsing sessions. At the same time, the presence of a suspicious advertisement should not automatically be treated as proof that a device has been infected. Establishing a compromise generally requires technical evidence, such as device analysis, network records or indicators associated with a known spyware operation.
The latest findings are likely to increase pressure on advertising platforms to strengthen controls over the companies that buy, sell and distribute online advertisements. Possible safeguards include more rigorous verification of advertising partners, independent security audits, better monitoring of suspicious traffic, restrictions on the collection and exchange of sensitive identifiers, and faster procedures for suspending companies that violate platform rules. Regulators may also face renewed calls to clarify the responsibilities of advertising intermediaries when their systems are allegedly used to facilitate surveillance or the distribution of malicious software.
For internet users, the investigation highlights the limits of relying on caution alone. Avoiding suspicious links remains useful, but it cannot prevent every form of tracking that occurs through embedded advertising systems. Keeping operating systems and applications updated, limiting unnecessary advertising identifiers, reviewing app permissions and using reputable security tools can reduce some risks. Organisations handling sensitive information may also need to assess advertising and tracking exposure on work devices, particularly when employees regularly access public websites and third-party applications.
The Citizen Lab and Confiant investigations have exposed a troubling possibility: technology built to deliver advertisements can also become part of an infrastructure for surveillance. The reported links between Discover-Tech, Candiru and major advertising systems raise questions about the oversight of digital markets, the protection of personal information and the security of institutions that depend on internet-connected devices. Google’s ban on Discover-Tech and the actions taken by other industry organisations are significant steps, but the wider challenge remains unresolved. As advertising systems continue to collect and exchange information across the internet, governments, technology companies and independent researchers will face growing pressure to ensure that commercial data infrastructure cannot be easily repurposed to monitor individuals or expose sensitive networks to spyware.
Source: Reuters reporting on investigations by Citizen Lab and Confiant, published October 15, 2026. Additional reporting details attributed to the original investigations and the organisations cited in the report.
Published by: Al-Mujaddid 24com
Disclaimer: The allegations described in this report are attributed to the cited investigations and reporting. The presence of advertisements on an institution’s network does not, by itsel. Source: Reuters
