Israeli ad firm exploited online ads to run global spyware campaign
Researchers say Israeli agency Discover-Tech used advertising networks to deliver spyware, including Candiru, to users worldwide, prompting major platforms to block the firm.
Citizen Lab and Confiant uncovered that the Israeli digital-advertising company Discover-Tech ran a massive espionage scheme by embedding malicious ads across a vast web of publishers and apps. The ads, often disguised as ordinary product promotions, could track users simply by loading and sometimes delivered Candiru spyware, which the U.S. Commerce Department blacklisted in 2021. The campaign reached more than 120,000 sites, 75,000 apps and networks tied to the Pentagon, International Atomic Energy Agency, United Nations and numerous national governments, with researchers estimating hundreds of millions of people may have been exposed.
Candiru-laden ads were linked to attacks on 45 Windows machines at one outlet between 2024 and 2025. Following the findings, Google, IAB Europe and Comcast’s Beeswax suspended Discover-Tech’s access to their platforms. The firm, founded in 2020, has not responded to contact attempts.
Why it matters
The story shows how ad tech can be weaponized for state-level spying, threatening privacy and security worldwide.
In this story
