An Israeli digital advertising company exploited targeted online ads to facilitate spyware attacks, track internet users and potentially compromise devices without any user interaction, an investigation has found.
The research by the University of Toronto’s Citizen Lab found that malicious advertisements purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company were used to deliver Candiru spyware, now rebranded as Integrity Labs, to devices belonging to staff at international news networks, including Qatar-based Al Jazeera.
Researchers identified 45 compromised Windows devices between 2024 and 2025, providing the first public technical confirmation of mercenary spyware being delivered through targeted advertising without users having to click on an advertisement.
The report, which calls the technique AdFection, details how Discover-Tech’s advertising infrastructure enabled surveillance partners to identify, fingerprint and track devices, and potentially infect them when advertisements were displayed. The findings raise serious concerns about the misuse of commercial advertising networks for covert espionage and mass surveillance.
An analysis of approximately four billion advertising-bidding records found that Discover-Tech advertisements appeared on nearly 200,000 unique websites and within Android and iOS applications across dozens of countries over a four-month period.
A separate investigation by advertising security firm Confiant, reported by Reuters on October 15, 2026, found that Discover-Tech’s advertising network reached more than 120,000 websites and 75,000 applications.
Confiant estimated that the company distributed at least 10 million advertisements daily, although advertisements linked to Candiru spyware accounted for only a small fraction of Discover-Tech’s overall advertising volume, according to the firm.
Researchers said the advertisements could be used to identify and track internet users, while some were linked to efforts to deliver spyware. Discover-Tech’s infrastructure was also linked to other surveillance-related entities, including Intelos and Bindecy.
Separately, Citizen Lab identified a threat actor it calls DARK CARTOGRAPHER, which it said was exploiting mobile-carrier vulnerabilities to link advertising identifiers to phone numbers and de-anonymize users on a large scale.
The investigation also raised concerns about the reach of Discover-Tech’s advertising infrastructure. Citizen Lab reported evidence that advertisements appeared within networks associated with the United Nations, NATO, the European Commission and more than a dozen national governments.
Confiant separately reported malicious advertisements appearing in sensitive networks, including those associated with the Pentagon, the International Atomic Energy Agency and the International Criminal Court (ICC).
Researchers also raised concerns about the concentration of Discover-Tech advertisements in Palestinian online spaces, potentially giving the company and its surveillance partners extensive visibility into users’ digital activities.
Citizen Lab and Confiant’s findings have prompted several advertising industry organizations and technology companies to take action against Discover-Tech.
Google said it had removed the company from its advertising platforms for systematically violating its policies.
IAB Europe suspended Discover-Tech from its list of approved vendors following an audit, while Comcast’s advertising technology subsidiary, Beeswax, also removed it from its platform. Citizen Lab said Vungle, operated by Liftoff, and Eskimi had likewise taken steps to disconnect Discover-Tech from the advertising ecosystem.
Citizen Lab has called on regulators to investigate whether Discover-Tech and Candiru, now rebranded as Integrity Labs, violated applicable laws.
The findings also expose broader weaknesses in advertising systems that allowed a company presenting itself as a legitimate advertising business to operate infrastructure used for surveillance and spyware delivery.
The report comes amid earlier reports that Microsoft and other major global technology companies have played a significant role in Israel’s genocidal war on Gaza by providing the occupying entity with advanced artificial intelligence (AI) tools, financial support and personnel.
This makes it easy to access the Press TV website