Israeli Ad Firm Potentially Spied on Millions Through Zero-Click Spyware Hidden Behind Ordinary Online Ads

 Israeli Ad Firm Potentially Spied on Millions Through Zero-Click Spyware Hidden Behind Ordinary Online Ads.

Discover-Tech advertisements appeared on more than 120,000 websites and 75,000 apps, raising fears of mass surveillance as Google terminates the Israeli firm's access to its advertising platforms.

An Israeli digital advertising company, Discover-Tech, has come under scrutiny following revelations that its online advertising infrastructure was allegedly used to track internet users and deliver sophisticated spyware to targeted devices without requiring victims to click on anything.

A joint investigation by Citizen Lab, a cybersecurity research group at the University of Toronto, and advertising security company Confiant has exposed how seemingly ordinary online advertisements may have been weaponised to facilitate covert surveillance on a potentially enormous scale.

According to the findings published on October 15, 2026, Discover-Tech's advertisements appeared across more than 120,000 websites and 75,000 mobile applications. Researchers warn that the company's advertising operations may have reached hundreds of millions of people worldwide.

The revelations have prompted Google to terminate Discover-Tech's access to its advertising exchange platforms, while other companies and advertising industry organisations have also taken action against the firm.

The investigation raises serious questions about online privacy, digital security and the ability of commercial advertising networks to become channels for sophisticated surveillance operations.

How Ordinary Online Advertisements Became a Potential Spyware Delivery System.

One of the most alarming aspects of the investigation is that the advertisements reportedly looked entirely normal.

Rather than displaying obvious malicious content, Discover-Tech's advertisements often promoted ordinary consumer products, including mobile phones and wireless earbuds.

To an unsuspecting internet user, there was little reason to suspect that an advertisement appearing on a website or inside a mobile application could be connected to a surveillance operation.

However, researchers discovered that the advertising infrastructure could identify and track devices and, in selected cases, facilitate the delivery of spyware.

The investigation identified a system researchers call AdFection, through which targeted advertisements could be used as a pathway for zero-click spyware attacks.

Unlike conventional cyberattacks that require victims to click on a suspicious link, download a malicious file or approve an installation, zero-click attacks can exploit vulnerabilities without any deliberate action by the victim.

In the case documented by Citizen Lab, the advertising process could trigger code to be delivered to a targeted device when an advertisement was displayed.

This meant that a person could potentially be exposed to a sophisticated attack simply by visiting a website or using an application carrying a targeted advertisement.

The distinction is crucial: the advertisement itself did not necessarily look malicious, and most people encountering it would have had no reason to suspect that anything unusual was happening.

Researchers said the infrastructure enabled spyware operators to select particular devices for further targeting while presenting seemingly harmless advertisements to other users.

This approach could make malicious activity harder to detect because advertising platforms and security scanners might encounter advertisements that appeared legitimate to the overwhelming majority of viewers.

"Source: Citizen Lab's investigation into AdFection" (https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/).

Hundreds of Millions of People Potentially Exposed.

The scale of Discover-Tech's advertising operations is another major concern.

According to the investigation, the company's advertisements appeared on more than 120,000 websites and approximately 75,000 mobile applications through its advertising partnerships.

Researchers analysed billions of advertising-bidding records to understand the company's activities between March and June 2026.

These records showed that Discover-Tech operated across an extensive digital advertising ecosystem, reaching users through numerous websites and applications in different countries.

Confiant co-founder Jerome Dangu estimated that Discover-Tech was distributing at least 10 million advertisements daily around the world.

He warned that, considering the company's advertising reach and data-sharing arrangements, hundreds of millions of people were very likely to have been exposed to its operations.

However, it is important to distinguish between exposure to an advertisement and infection with spyware.

The researchers' findings do not establish that hundreds of millions of people had their devices hacked. Rather, the figure reflects the potential reach of the company's advertising and tracking infrastructure.

The evidence indicates that Discover-Tech's operations could collect information from devices encountering its advertisements, while more intrusive spyware attacks were directed at selected targets.

The investigation also found that the company's advertisements covertly directed millions of devices to contact servers associated with surveillance infrastructure.

These connections could facilitate device identification, tracking and reconnaissance, although a connection to a server does not, by itself, prove that a device was infected.

The findings nevertheless demonstrate how an advertising network with enormous reach could potentially support surveillance far beyond the small number of devices on which spyware infections have been directly confirmed.

Google's Decision to Cut Ties With Discover-Tech

Google has terminated Discover-Tech's access to its advertising exchange platforms following the investigation.

The company had previously appeared on advertising vendor lists that helped establish its status within the digital advertising ecosystem.

According to Citizen Lab, Discover-Tech had been listed among approved or certified advertising vendors for several years before its removal in October 2026.

The investigation also prompted action from other industry participants.

IAB Europe removed Discover-Tech from its vendor registry, while advertising technology companies including Beeswax and Eskimi took steps to block the company's access or accounts. Vungle, operated by Liftoff, reportedly paused Discover-Tech's access while reviewing the findings.

These decisions represent a significant response to allegations that commercial advertising infrastructure was being used to facilitate surveillance and spyware delivery.

Google's action is particularly consequential because large advertising exchanges connect advertisers with enormous numbers of websites and applications.

The incident illustrates the risks associated with allowing a company to participate in a trusted advertising ecosystem when its underlying activities may differ substantially from the ordinary advertising services it appears to provide.

It also raises questions about how long surveillance-related operations can remain embedded within mainstream advertising systems before they are detected.

"Source: Reuters report on the investigation and industry response" (https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/).

Al Jazeera Devices Were Compromised Through the Advertising System

Among the most significant findings was evidence linking the advertising infrastructure to spyware infections involving devices at Al Jazeera, the Qatar-based international news organisation.

Citizen Lab reported that it confirmed the compromise of 45 Windows devices at the broadcaster between 2024 and 2025.

According to the researchers, the attacks involved spyware developed by Candiru, an Israeli surveillance technology company that has also been known as Saito Tech and is now associated with the name Integrity Labs.

Citizen Lab said the infections were linked to the advertising-based attack mechanism it documented.

The findings are particularly troubling because journalists and media organisations can possess information that powerful political, commercial and security interests may seek to obtain.

A compromised journalist's computer could potentially expose confidential communications, contacts, research materials and other sensitive information, depending on the spyware's capabilities and the level of access obtained.

For a newsroom operating across international borders, such a compromise could also create risks for sources who rely on confidentiality when sharing information about corruption, human rights abuses or government activities.

However, the investigation's confirmed findings concerning Al Jazeera should not be interpreted as proof that every organisation whose network displayed Discover-Tech advertisements was similarly compromised.

The researchers distinguished between evidence of actual infections and evidence that advertisements reached devices connected to potentially sensitive networks.

That distinction is important when assessing the full scale of the operation.

Government and International Networks Also Came Into Focus.

The investigation uncovered evidence that Discover-Tech advertisements appeared on devices associated with sensitive networks, including those connected to government, military and international institutions.

Confiant reported that the advertisements reached networks in sensitive categories, including the Pentagon, the International Atomic Energy Agency and the International Criminal Court.

Other reporting has also highlighted possible exposure involving NATO and additional major organisations.

These findings raise concerns about the security of institutions that handle confidential government information, international diplomacy, defence matters and nuclear oversight.

However, the presence of advertisements on devices connected to these networks does not automatically establish that their systems were breached or that classified information was stolen.

The significance lies in the potential for an advertising-based surveillance system to reach individuals operating within sensitive environments without needing to penetrate an organisation's central network directly.

If a particular individual can be identified and selected through advertising data, the advertising ecosystem may provide a pathway for targeting that person's device.

This presents a different kind of cybersecurity challenge from traditional attacks that begin with phishing emails, compromised passwords or direct exploitation of an organisation's servers.

It also illustrates why digital advertising should not be viewed solely as a commercial activity when the same infrastructure can potentially be repurposed for covert surveillance.

How Advertising Data Can Help Identify Internet Users.

The investigation also highlights the privacy implications of the technology underpinning targeted advertising.

Online advertisements are frequently distributed through real-time bidding systems, in which advertising companies compete to display advertisements to particular users.

These transactions can involve information about a device, its internet connection and identifiers used by advertising platforms.

Such information can include internet protocol addresses, mobile advertising identifiers and other technical signals that help advertising companies distinguish between devices and associate activity across different services.

Discover-Tech's infrastructure reportedly used methods to connect identifiers and track devices across advertising networks.

One technique, known as cookie matching, allows advertising companies to associate identifiers used by different systems so that information about a particular user or device can be linked across platforms.

Although these mechanisms are commonly associated with advertising and audience measurement, researchers found that the same infrastructure could be exploited to support surveillance.

This is where the potential danger extends beyond the installation of spyware.

Even when a device is not infected, the collection and correlation of identifying information can reveal patterns of online activity and help determine which devices should be targeted for further investigation.

When such information is combined with spyware capable of exploiting a device's vulnerabilities, ordinary advertising infrastructure can become a powerful tool for identifying and attacking selected individuals.

The problem is not simply that users see too many advertisements. It is that the systems distributing those advertisements can expose information about users and their devices to multiple commercial intermediaries.

If safeguards fail, that information can potentially be repurposed for activities far removed from selling consumer products.

Candiru and the Wider Commercial Spyware Industry.

The investigation also places Discover-Tech within the broader debate over the commercial spyware industry.

The researchers described Discover-Tech as a bridge between the commercial advertising ecosystem and the mercenary spyware industry.

That connection raises questions about the responsibility of advertising companies, technology platforms and intermediary businesses when their services are allegedly used to facilitate cyberespionage.

It also highlights the difficulty of regulating an industry in which several companies may participate in different stages of a surveillance operation.

An advertising platform might distribute an advertisement, another company might provide the targeting infrastructure, and a separate spyware developer might supply the technology used to compromise a device.

Understanding who is responsible requires investigators to examine the entire chain rather than focusing exclusively on the company that developed the spyware.