April

Millions

Simply

United

Israeli advertising firm Discover-Tech used ordinary online ads to track people and install spyware to their devices, as per <a href="https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15" rel="noopener noreferrer nofollow">Reuters</a>.
It was able to distribute ads across a vast network of websites and apps using advertising platforms operated by Google, Comcast and Yandex. Independent investigations by <a href="https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/" rel="noopener noreferrer nofollow">Citizen Lab</a> and <a href="https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming" rel="noopener noreferrer nofollow">Confiant</a> revealed how the operation worked. Simply loading an ad could expose users to surveillance or spyware, even without clicking on it.
<h3 class="wp-block-heading" id="strong-why-a-loaded-ad-was-enough-to-compromise-a-device-strong">Why a loaded ad was enough to compromise a device</h3>
Real-time bidding auctions ad space in milliseconds, sharing device and location data with potential buyers. Some ads also run code. Citizen Lab calls the zero-click spyware technique AdFection and links Discover-Tech to Candiru, an Israeli spyware maker blacklisted by the US in 2021.
On April 12, 2026, Confiant found a MyIPInfo banner, which redirected to an infrastructure linked to Candiru through Amazon CloudFront. The ad loaded a fake verification tool that have about 90KB of hidden JavaScript. This allowed it to collect information about the device and communicate through an encrypted channel. Confiant investigated the activity between April and September 2026.
<h3 class="wp-block-heading" id="strong-45-infected-machines-at-al-jazeera-millions-more-exposed-strong">45 infected machines at Al Jazeera, millions more exposed</h3>
Citizen Lab examined four billion bidding records. It found out that Discover-Tech had booked its advertisements on at least 120,000 online sites and in 75,000 applications.
As per Confiant’s estimation, there are at least 10 million advertisements delivered via Discover-Tech in a day. Its cofounder Jerome Dangu said “very likely hundreds of millions of people would have been touched by Discover-Tech.”
Citizen Lab confirmed that Candiru spyware compromised 45 Windows machines at Al Jazeera during 2024–2025. The broadcaster said it “condemns the spyware attacks targeting a number of its staff.”
Discover-Tech ads are also shown on networks associated with government and international agencies, including the Pentagon, United Nations, NATO, European Commission, International Atomic Energy Agency and International Criminal Court. Researchers also detected Discover-Tech ads on networks associated with chipmakers Nvidia, Broadcom and Micron.
However, exposure does not necessarily mean infection. Unlike the reported compromises at Al Jazeera, these appearances do not establish that spyware successfully infected devices at those institutions.
<h3 class="wp-block-heading" id="strong-google-iab-europe-and-beeswax-cut-off-access-strong">Google, IAB Europe and Beeswax cut off access</h3>
Google removed Discover-Tech from its advertising platform “for systematically violating our policies.” IAB Europe also dropped the ads company from its list of approved vendors. Comcast’s Beeswax blocked its access to the platform.
The findings raised wider concerns about online advertising security. Citizen Lab researcher Wolfie Christl warned that “the way online advertising works today is a systemic security threat.”
<h3 class="wp-block-heading" id="strong-a-1-34-trillion-market-built-on-the-same-plumbing-strong">A $1.34 trillion market built on the same plumbing</h3>
The advertising market continues to grow, raising the stakes for security. WARC expects <a href="https://d3181cv23ky2c4.cloudfront.net/press-release/warc-global-ad-spend" rel="noopener noreferrer nofollow">global ad spending</a> to reach $1.34 trillion in 2026. In the US, programmatic advertising earned a staggering $162.4 billion in 2025 according to <a href="https://www.iab.com/news/digital-ad-revenue-climbs-to-nearly-300b-as-iab-celebrates-30-year-anniversary" rel="noopener noreferrer nofollow">IAB numbers</a>. But security measures have been unable to keep up with the increasing application of artificial intelligence in the advertising industry.
<a href="https://www.iab.com/news/iab-announces-project-eidos" rel="noopener noreferrer nofollow">IAB research</a> shows only about 40% of the surveyed ad buyers have already done or plan to do something regarding legal, security, and data risks related to AI-powered measurement.
Norway recently <a href="https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data" rel="noopener noreferrer nofollow">fined Microsoft-owned Xandr</a> NOK 92 million for unlawfully sharing sensitive Grindr data through ad auctions. It was a privacy violation, not a spyware case. Regulator Line Coll said responsibility “cannot be passed on to others.”
<div class="wp-block-image">
 <figure class="aligncenter size-large">
 <figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/Ad-Tech-Spyware_-Exposure-vs-Harm-1024x576.png" alt="" width="1024" height="576">
 <figcaption>
 Discover-Tech spyware campaign: Millions exposed, 45 devices infected
 </figcaption>
 </figure>
 </figure>
</div>
The Discover-Tech case comes as advertising companies are increasingly investing in consumer data and AI-powered targeting. As <a href="https://www.cryptopolitan.com/publicis-groupe-expands-ai-ambitions" rel="noopener noreferrer nofollow">Cryptopolitan</a> previously reported, Publicis Groupe signed an agreement to buy LiveRamp for $2.2 billion, thus enhancing its AI-based marketing activities.
While the deal has no connection to the spyware attacks, it shows how important data and automation have become to the industry. The findings also raise questions about whether existing security measures are keeping pace.
Citizen Lab has called for investigations into Discover-Tech and Candiru, putting pressure on advertising platforms to improve how they screen vendors and detect malicious ads.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

Israeli ad firm used online ads to deliver zero-click spyware, researchers say

Table of Contents

Cryptopolitan_News

Other articles published on Oct 16, 2026

Aster DEX vs. Hyperliquid: Why Does Everyone Compare The Two?

Can Stellar Really Help People Without Bank Accounts?

Bitget Got Hacked. Why Is THORChain on Trial?

"Vibe Coding" Meets the Internet Computer: A Plain-English Glossary for the AI App-Building Era

Why Have Nonprofits And NGOs Gravitated Toward Stellar’s Network?

What Makes Ondo Stocks Different From Other Tokenized Stocks?

Join our free newsletter for daily crypto updates!