Wired for War: Israeli firm ran global surveillance operation through online ads, investigation finds

Discover-Tech exploited digital advertising infrastructure to track targets and deliver spyware, according to two research teams Israeli ad tech company Discover-Tech exploited online advertising infrastructure to track targets and help deliver spyware to dozens of devices belonging to Al Jazeera staff and members of other entities, according to investigations by the Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.

The researchers said Discover-Tech used a sprawling network of online ads to identify potential targets, monitor their activity and facilitate the compromise of their devices.

“The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting,” Confiant said in its findings.

Devices belonging to staff at the international news network Al Jazeera were among those infected through malicious ad placements, which operated silently, without visible pop-ups or suspicious links.

The Qatar-based media network condemned “the spyware attacks targeting a number of its staff,” describing them as an “assault on press freedom,” and called for those responsible to be held accountable.

Read more Wired for War: The German spymaster caught in Mossad’s web The investigation also linked the malicious activity to Israeli spyware developer Candiru, which has been blacklisted by the US and rebranded as Integrity Labs, and Israeli surveillance technology provider Intelos.

The companies allegedly exploited ad inventory on major platforms, including Google, Russia’s Yandex and US ad tech platform Beeswax to track targets and compromise consumer devices.

Discover-Tech used a system called Controlium to turn routine ad auctions into a surveillance tool.

Over four months, it served ads across nearly 200,000 websites and mobile apps on Android and iOS devices in dozens of countries.

According to Confiant, the company generated about 10 million ad impressions daily, harvesting device fingerprints, IP addresses, authentication tokens, cookies and other personal data, including without consent where required under EU privacy rules.

Citizen Lab also identified a group linked to Discover-Tech, dubbed Dark Cartographer, which allegedly exploited vulnerabilities at mobile carriers and matched advertising IDs with phone numbers to track subscribers on a large scale.

Geographic data revealed sharp spikes in traffic that researchers said pointed to targeted intelligence-gathering operations rather than routine commercial advertising.