Researchers say Discover-Tech ads tracked users, extracted data, and helped deliver powerful spyware worldwide.
Ordinary-looking online advertisements may have served a far more intrusive purpose. Cybersecurity researchers say an Israeli advertising company built a global advertising network capable of identifying internet users and supporting spyware attacks without requiring them to click an ad.
Ads Reached Thousands of Sites and Apps
Israeli digital advertising agency Discover-Tech allegedly used online advertisements to track internet users and assist efforts to compromise devices, according to separate investigations by Canadian research group Citizen Lab and New York advertising security company Confiant. Citizen Lab said Discover-Tech advertisements reached more than 120,000 websites and 75,000 apps through various partnerships, while Confiant estimated the company was distributing at least 10 million ads per day worldwide.
Users Could Be Tracked Without Clicking
Researchers said the advertisements often promoted ordinary products such as smartphones or earbuds, but could identify and track people simply when the ads loaded on a website or app. In some cases, Discover-Tech allegedly attempted to extract phone numbers from smartphone users. Confiant said data-sharing arrangements known as cookie matching could also enable tracking beyond websites directly displaying Discover-Tech advertisements.
Researchers Link Ads to Candiru Spyware
According to Citizen Lab and Confiant, Discover-Tech provided Israeli spyware company Candiru and other surveillance firms with access to advertising platforms operated by Google, Comcast, Yandex, and other companies. Researchers said some advertisements helped deliver Candiru spyware, although Confiant found that ads linked to Candiru accounted for only a small fraction of Discover-Tech’s overall advertising volume. Citizen Lab said it confirmed that 45 Windows devices at Al Jazeera were compromised between 2024 and 2025 using Candiru spyware delivered through Discover-Tech’s advertising infrastructure, based on network logs provided by the broadcaster.
Sensitive Networks Allegedly Exposed
Confiant said Discover-Tech advertisements appeared across hundreds of networks considered sensitive, including those associated with the Pentagon, International Atomic Energy Agency, and International Criminal Court. Citizen Lab separately said it found evidence that the ads appeared to users within the United Nations, NATO, European Commission, and more than a dozen national governments. Confiant co-founder Jerome Dangu estimated that hundreds of millions of people were likely exposed to Discover-Tech advertisements, although exposure itself does not mean every user was hacked.
Technology Companies Cut Discover-Tech Off
Google said it removed Discover-Tech from its advertising platforms for systematically violating company policies after cooperating with the investigations. IAB Europe suspended the company from its list of approved vendors following an audit, while Comcast subsidiary Beeswax also removed Discover-Tech from its platform. Discover-Tech and its chief executive did not respond to Reuters’ requests for comment, while attempts to reach Candiru’s owners were also unsuccessful.
The findings raise wider concerns about how online advertising infrastructure can potentially be repurposed for surveillance rather than conventional marketing. Although the reports do not identify Indonesian or Singaporean victims, researchers described modern advertising systems as a security concern affecting governments, businesses, civil society, and individual users globally, making the investigation relevant to internet users across both countries.
Sources: Straits Times (2026) , Reuters (2026)
Keywords: Discover-Tech Spy Operation, Online Advertising Surveillance, Candiru Spyware, Citizen Lab Research, Malicious Online Ads, Digital Privacy
