Israeli digital advertising agency Discover-Tech spied on internet users through a network of online advertisements that it used to track targets and hack their devices, research groups said.
Reports from Canadian group Citizen Lab and US advertising security company Confiant found that Discover-Tech's services gave Candiru, an Israeli spyware company blacklisted by the US government, as well as other Israeli surveillance groups, access to advertising platforms run by companies including Google, Comcast and Russia's Yandex.
Discover-Tech's online ads, often for ordinary products such as phones or earbuds, reached more than 120,000 websites and 75,000 apps through its various partnerships, Citizen Lab said.
People who visited sites or used apps with the malicious ads could be identified and tracked by Discover-Tech, which would sometimes try to extract phone numbers from smartphone users, researchers said. Ads only needed to load on a website for the spying to occur.
Some ads would be used to help plant spyware from Candiru on users' devices, the research groups said. But Confiant said that ads it tied to Candiru were a fraction of Discover-Tech's overall volume.
Discover-Tech was issuing at least 10 million ads a day around the world, with data-sharing arrangements called cookie matching allowing it to track people beyond the reach of its ads, Confiant co-founder Jerome Dangu said. "Very likely hundreds of millions of people would have been touched by Discover-Tech," he added.
Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech's ads had been used to compromise 45 Windows devices at Qatar's Al Jazeera between 2024 and 2025. That was confirmed because the media group shared its network logs with the group, it added.
Al Jazeera said in a statement that it "condemns the spyware attacks targeting a number of its staff" and that it was taking steps to protect its employees and its systems. "Those responsible must be held accountable," it said.
Mr Dangu said the malicious ads had been shown to users in "hundreds of networks in sensitive categories", including the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He also said that some regions, including the Palestinian territories, were saturated by the Israeli company's ads.
"You go to almost any site in Palestine – any site – you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country," he added.
Citizen Lab said it had evidence that the malicious ads were shown to people in the UN, Nato, the European Commission and more than a dozen national governments. The ads also appeared in networks including technology companies such as Nvidia and Sandisk, as well as media organisations in Mexico, Israel and Europe.
Discover-Tech is now to be frozen out of parts of the online ad market. Google said in a statement that it had collaborated with Citizen Lab and Confiant's investigation and kicked Discover-Tech off its ad platforms "for systematically violating our policies".
IAB Europe, the European-level association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had been suspended from its list of globally approved entities last week after an audit identified policy breaches.