On the morning of 15 October 2025, two research organisations on opposite sides of the Atlantic published reports that, taken together, describe what may be the most significant convergence yet of two industries long suspected of operating in the shadows: commercial spyware and digital advertising. The picture they paint is not one of a rogue operation at the margins of the internet economy, but of a sprawling, industrialised surveillance apparatus embedded in the very plumbing of the web, an apparatus that reached the Pentagon, the International Atomic Energy Agency, the International Criminal Court, the United Nations, NATO, and the European Commission, and that counted among its victims at least 45 devices belonging to journalists at Al Jazeera.

The firm at the centre of the allegations is Discover-Tech, an Israeli digital advertising agency founded in 2020 and led by CEO Dekel Boni. According to separate investigations by the University of Toronto’s Citizen Lab and New York-based advertising security firm Confiant, Discover-Tech operated a platform called Controlium that “allows malicious actors to precisely profile and de-anonymise millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.”

The reports, released under the title “Exposing AdFection,” detail how Discover-Tech’s advertising network, ostensibly a legitimate programmatic ad business placing promotions for ordinary consumer products like mobile phones and earbuds, served as a delivery mechanism for spyware developed by Candiru, an Israeli surveillance vendor blacklisted by the US Department of Commerce in 2021 for supplying spyware used to maliciously target government officials, journalists, activists, and academics.

“The way online advertising works today is a systemic security threat,” Wolfie Cristl, a senior researcher at Citizen Lab, told Reuters. “For states, the private sector, civil society and everyone else alike.”

That assessment, delivered with the clinical understatement of a researcher who has spent years documenting the excesses of the commercial spyware industry, may prove to be one of the most consequential statements of the year. For it is not merely an observation about one company’s misdeeds. It is an indictment of an entire ecosystem, one that has, for decades, been permitted to operate on the assumption that the collection and monetisation of personal data is a benign, if occasionally irritating, feature of the modern internet.

The Architecture Of Ad-Based Espionage

To understand the scale of what Discover-Tech is alleged to have built, one must first understand the mechanics. The global programmatic advertising system is, by design, a surveillance network. Every time a user loads a webpage or opens a mobile app, a complex chain of data brokers, demand-side platforms, supply-side platforms, ad exchanges, and verification vendors is triggered. In the milliseconds it takes for an ad to appear, these entities share information about the user, their device type, location, browsing history, inferred interests, and a persistent identifier that allows them to be tracked across sites and apps.

This system, often described euphemistically as “personalisation,” is the economic engine of the open web. It is also, as Citizen Lab and Confiant make clear, a ready-made infrastructure for state-sponsored surveillance.

Discover-Tech’s alleged innovation was to fuse this infrastructure with offensive cyber capabilities. According to the reports, the company’s ads reached more than 120,000 websites and 75,000 apps through partnerships with major advertising platforms, including Google’s, Comcast’s Beeswax, and Russia’s Yandex. In a single four-month period between March and June 2025, Citizen Lab’s review of server records showed that Discover-Tech ads were served in almost 200,000 different Android apps, iOS apps, and websites.

“Very likely hundreds of millions of people would have been touched by Discover-Tech,” said Confiant co-founder Jerome Dangu, who noted that the firm was pumping out at least 10 million ads per day globally.

The ads themselves were often unremarkable, promotions for consumer electronics, the kind of digital detritus that internet users have long since learned to ignore. But embedded within them was code that, once loaded, would identify and track the user, sometimes attempting to extract phone numbers from smartphone users. No click was required. The mere display of the ad was sufficient for the surveillance to begin.

Some of these ads went further. According to both research groups, a subset of Discover-Tech’s advertising inventory was used to deliver spyware from Candiru, a form of malware capable of compromising a device completely, granting the attacker access to communications, files, location data, and even the device’s microphone and camera. Confiant emphasised that ads tied to Candiru represented “a tiny fraction” of Discover-Tech’s overall volume, but the implications of even a small number of such infections are profound.

Al Jazeera: A Case Study In Targeted Surveillance

The most detailed evidence of Discover-Tech’s alleged spyware delivery concerns Al Jazeera, the Qatari broadcaster whose journalists have long been targets of surveillance by regional adversaries. According to Citizen Lab, a powerful form of Candiru spyware delivered through Discover-Tech’s ads was used to compromise 45 Windows devices at Al Jazeera between 2024 and 2025.

The investigation was prompted by Al Jazeera’s own internal technology team, which first detected unusual patterns on devices used by some journalists in 2024. The pattern continued into 2025, prompting the network to reach out to Citizen Lab for a more detailed investigation.

“Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed,” the Citizen Lab report states.

Al Jazeera Media Network said in a statement that it “condemns the targeting of devices belonging to several of its employees with spyware” and pledged to continue to “protect its employees and systems.” The network described the targeting of journalists as “an assault on press freedom and the public’s right to knowledge” and called for those responsible to be held accountable.

The Committee to Protect Journalists (CPJ) echoed that call. “The mass surveillance architecture supporting online advertising is being harnessed for other purposes and puts journalists at risk,” said Jonathan Rozen, CPJ’s deputy director of research. “Citizen Lab’s findings that Al Jazeera devices were infected with spyware delivered via targeted ads make these surveillance dangers even clearer.”

Rozen, who reported on such threats in August 2025 in a joint publication by CPJ and Harvard University’s Carr-Ryan Centre for Human Rights, has been documenting the intersection of ad-tech and surveillance for months. That report warned that mass surveillance from online advertising threatens journalists and press freedom, including by enabling harvesting of personal data, location tracking, and ad-delivered spyware.

Citizen Lab’s investigation did not name a specific government or client of Discover-Tech or Candiru as responsible for ordering the attacks on Al Jazeera. But the report noted that Discover-Tech-facilitated ads had been delivered to networks of other media organisations located in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden, as well as to networks of international media services. The report did not name the other outlets, noting that investigations into those cases are ongoing.

These ad impressions alone do not confirm spyware targeting, Citizen Lab cautioned, but they “minimally suggest profiling of the devices by Discover-Tech and/or its surveillance partners.”

Beyond The Newsroom: Sensitive Networks Compromised

The reach of Discover-Tech’s advertising network extended far beyond media organisations. According to Confiant’s Dangu, the malicious ads were shown to users in “hundreds of networks in sensitive categories,” including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.

“You go to almost any site in Palestine, any site, you find a Discover-Tech ad,” Dangu said. “It gives them a very complete visibility on the digital activities of an entire country.”

Citizen Lab said it had similar evidence showing the malicious ads were shown to people in the United Nations, NATO, the European Commission, and more than a dozen other national governments. Other networks where the ads appeared included chip-related firms such as Nvidia, Sandisk, Broadcom, and Micron, as well as several media organisations in Mexico, Israel, and Europe that were not identified.

The presence of Discover-Tech ads in these networks does not, by itself, prove that spyware was delivered to every user who saw them. But it does demonstrate the extraordinary reach of the operation and the potential for abuse. A single ad impression in a sensitive network, a defence ministry, a nuclear watchdog, a war crimes tribunal, could be sufficient to compromise a device and ex filtrate its contents.

In addition to identifying Candiru and a couple of other surveillance vendors, Citizen Lab said it was able to glean some details about where Discover-Tech’s users might be based because the firm inadvertently exposed its authentication logs to the internet. Those logs showed people logging in from IP addresses in Israel, Europe, and the Gulf—a detail that, while not conclusive, offers a glimpse into the operational geography of the firm.

The Israeli Surveillance Industry: A Broader Context

Discover-Tech is not an isolated actor. It is a product of, and a contributor to, Israel’s thriving offensive cyber and digital surveillance industry, a sector that has grown largely unregulated, selling powerful spyware to government clients worldwide.

A separate investigation by Haaretz Magazine and the newspaper’s National Security and Cyber digital investigation desk, published in the wake of the Citizen Lab and Confiant reports, revealed that a number of Israeli firms have developed technologies capable of exploiting advertising to collect data and monitor citizens. The Haaretz investigation described the emergence of a new field it called “AdInt”, the fusion of advertising intelligence and offensive cyber capabilities.

“The new spyware exploits the world of digital advertising, which is supposed to be completely anonymous, to bypass the security mechanisms of Apple, Google and Microsoft and install advanced spyware on civilians’ telecom devices,” the Haaretz investigation reported. “Such capabilities were only available to states until now.”

One company named in the Haaretz report is Insanet, whose existence was made public for the first time. The company is said to possess “insane capabilities,” according to sources in the industry, and is owned by former ranking members of Israel’s defence establishment, including Dani Arditi, a past head of the National Security Council. Insanet has developed technology that exploits ads both for tracking and for infection, and has named its product “Sherlock.” The company is said to have obtained authorisation from the Israeli defence ministry to sell its technology globally.

Another Israeli firm, Rayzone, has developed a similar product and this year received approval in principle to sell it to clients in the West.

“These capabilities can turn any ad into a kind of digital bullet,” a source familiar with the technology told Haaretz.

The Haaretz investigation described its findings as a story about “how advertisements turned into tools of war on the digital battlefield.” It highlighted the connection between the world of espionage and the private market, what it described as a perfect example of “surveillance capitalism,” where information collected for commercial ends is exploited by states for intelligence purposes and morphs, with a little help from Israeli high-tech entrepreneurs, into a security product liable to become a weapon against private citizens.

There are currently no defences against these technologies, and it is not clear whether they can be blocked at all. Even the most advanced defences of Apple, Google, and Microsoft currently lack the capacity to block this sort of infection, according to the Haaretz investigation.

Officials worry that the spyware industry is already out of control and fear how Israel’s tools will be used by undemocratic states once exported. Human rights advocates warn that ad-based hacking techniques could enable targeted state surveillance and repression of dissidents and minorities.

The Corporate Response: Damage Control Or Systemic Reform?

In the days following the publication of the Citizen Lab and Confiant reports, several major players in the online advertising ecosystem moved to distance themselves from Discover-Tech.

Google said in a statement that it had collaborated with the Citizen Lab and Confiant investigations and kicked Discover-Tech off its ad platforms “for systematically violating our policies.”

IAB Europe, the European-level association for the digital marketing and advertising ecosystem, said in an email that Discover-Tech had been suspended from its list of globally approved vendors last week after an audit identified policy violations.

Comcast ad tech subsidiary Beeswax removed Discover-Tech from its platform “following recent activity,” Comcast said in a statement.

Yandex, the Russian internet giant whose advertising platform was also used by Discover-Tech, did not return Reuters messages seeking comment.

Reuters’ attempts to reach Discover-Tech were unsuccessful. The company did not return messages left via its contact form. A LinkedIn message and emails sent to its chief executive, Dekel Boni, were not returned. Reuters’ attempts to reach Candiru’s owners were also unsuccessful.

CPJ contacted Discover-Tech and Candiru/Integrity Labs by email to comment on the report and on its call for responsible parties to be held to account, but has not yet received a response. Al Jazeera also did not respond to CPJ’s request for comment.

The suspensions and removals are, on one level, a positive development. They demonstrate that the advertising industry has at least some capacity to police itself, or, at minimum, to respond to public pressure and reputational risk. But they also raise uncomfortable questions. Discover-Tech was founded in 2020. It operated for five years, pumping out millions of ads per day, reaching hundreds of thousands of websites and apps, and allegedly delivering spyware to devices in some of the most sensitive networks in the world. Why did it take a Citizen Lab investigation, published in October 2025, for these platforms to act?

The answer, according to critics, lies in the fundamental structure of the online advertising industry. The programmatic ad ecosystem is vast, complex, and deliberately opaque. Ads are bought and sold through layers of intermediaries, making it difficult, if not impossible, for any single platform to know who is ultimately placing an ad, where it is being displayed, and what code it contains. The system is designed for scale and speed, not for security or accountability.

“The way online advertising works today is a systemic security threat,” Citizen Lab’s Cristl told Reuters. The implication is clear: Discover-Tech is not an aberration. It is a symptom of a system that is fundamentally broken.

The Pentagon And The National Security Threat

The Citizen Lab and Confiant reports are not the first to warn that advertising-driven surveillance is a national security threat. Earlier in 2025, the Pentagon said it had received reports that US forces deployed to war zones had been targeted using location data harvested by ad tech firms and data brokers. Branches of the military have since disabled ad tracking on some devices.

That development, reported by various outlets in the months before the Discover-Tech revelations, should have been a wake-up call. It demonstrated that the same data collection practices that power targeted advertising, location tracking, device fingerprinting, cross-app tracking, could be weaponised against military personnel, intelligence officers, and diplomats. The fact that it took a Citizen Lab investigation to expose the full scale of the problem suggests that the warnings were not heeded.

The presence of Discover-Tech ads in networks belonging to the Pentagon, the IAEA, and the ICC is particularly alarming. These are not random websites or consumer apps. They are the digital infrastructure of institutions charged with upholding international law, monitoring nuclear proliferation, and defending democratic nations. The compromise of devices in these networks could have consequences that extend far beyond individual privacy, it could undermine the integrity of international governance and the security of democratic states.

The Journalists’ Dilemma

For journalists, the Discover-Tech revelations are a stark reminder of the risks they face in the digital age. The targeting of Al Jazeera’s journalists is not an isolated incident. Candiru’s spyware has previously been used to carry out surveillance on at least 100 journalists, dissidents, and others in several countries.

CPJ has published safety guidance for mitigating surveillance from ad tech, and Citizen Lab’s report includes protective actions, emphasising ad-blocking as a cybersecurity best practice. The report notes that “there is currently no consistently safe way” to be exposed to targeted ads.

That is a remarkable admission. It means that the simple act of browsing the internet, of doing one’s job, of seeking information, of communicating with sources, exposes journalists to the risk of state-sponsored surveillance. The tools that journalists rely on to research, report, and publish are the same tools that can be turned against them.

“This is not just about one company or one spyware vendor,” said a source familiar with the Citizen Lab investigation, speaking on condition of anonymity. “It’s about an entire ecosystem that has been allowed to develop without oversight, without accountability, and without any meaningful consideration of the security implications. The advertising industry has been treated as a commercial sector, not as a critical infrastructure. That needs to change.”

The Failure Of Regulation

The Discover-Tech case exposes the failure of regulation at every level. The commercial spyware industry, despite years of warnings from researchers, journalists, and human rights organisations, remains largely unregulated. The advertising technology industry, despite repeated privacy scandals and data breaches, continues to operate with minimal oversight. And the intersection of these two industries, ad-based espionage, is a regulatory no-man’s land.

The US government blacklisted Candiru in 2021, but that action did not prevent the company from continuing to operate. It did not prevent Discover-Tech from partnering with Candiru. It did not prevent the delivery of spyware to Al Jazeera’s journalists. And it did not prevent the appearance of malicious ads in the networks of the Pentagon, the IAEA, or the ICC.

The European Union’s General Data Protection Regulation (GDPR), hailed as a landmark privacy law, has done little to address the systemic risks posed by ad-tech surveillance. The regulation focuses on the collection and processing of personal data, but it does not address the security vulnerabilities inherent in the advertising ecosystem. It does not require ad platforms to verify the integrity of the code they serve. It does not mandate transparency in the programmatic supply chain. And it does not provide a mechanism for detecting and preventing ad-delivered spyware.

IAB Europe’s suspension of Discover-Tech, announced after the Citizen Lab and Confiant reports were published, is a case in point. The association acted only after the allegations became public. Its audit process, whatever it entails, did not detect the policy violations before they were exposed by researchers. And even now, the suspension is limited to IAB Europe’s list of globally approved vendors, a voluntary, industry-run certification that carries no legal weight.

The Way Forward: What Can Be Done?

The Citizen Lab and Confiant reports offer several recommendations for mitigating the risks posed by ad-based espionage. These include:

• Ad-blocking: Citizen Lab describes ad-blocking as “a cybersecurity best practice” and notes that “there is currently no consistently safe way” to be exposed to targeted ads. For journalists, activists, and anyone else at risk of targeted surveillance, ad-blocking is not merely a matter of convenience—it is a matter of security.
• Regulatory action: Citizen Lab’s Cristl has urged regulators to investigate the companies involved and to fix the systemic risks that enable malicious ad targeting. This would require, at minimum, mandatory transparency in the programmatic ad supply chain, security audits of Ad platforms, and legal accountability for companies that knowingly or negligently facilitate surveillance.
• Platform responsibility: Google, Comcast, Yandex, and other major ad platforms must take responsibility for the content they serve. The fact that Discover-Tech was able to operate for five years, reaching hundreds of thousands of websites and apps, suggests that these platforms’ vetting processes are inadequate. The removal of Discover-Tech from these platforms is a start, but it is not enough. What is needed is a fundamental redesign of the ad-tech ecosystem to prioritise security over scale.
• International cooperation: Ad-based espionage is a global problem that requires a global response. The US, the EU, and other governments must work together to develop international standards for ad-tech security and to hold companies accountable for violations. The blacklisting of Candiru was a step in the right direction, but it was not sufficient. What is needed is a coordinated, multilateral effort to regulate the commercial spyware industry and to prevent the weaponisation of advertising infrastructure.

Conclusion: The Ad Is The Weapon

The Discover-Tech case represents a paradigm shift in the world of surveillance. It is no longer necessary for a state to hack into a device directly, to exploit a zero-day vulnerability, or to install spyware through a phishing email. The ad itself is the weapon. The infrastructure of the open web, the same infrastructure that enables free communication, commerce, and access to information, has been turned into a surveillance machine.

“The way online advertising works today is a systemic security threat,” Wolfie Cristl said. That statement should be taken seriously. It is not an exaggeration. It is not hyperbole. It is a factual description of a system that has been allowed to develop without oversight, without accountability, and without any meaningful consideration of the security implications.

The question now is whether the Discover-Tech revelations will prompt meaningful reform, or whether they will be absorbed into the endless cycle of scandal and forgetting that characterises the modern tech industry. The answer will depend on whether governments, regulators, and the public are willing to confront the uncomfortable truth that the online advertising ecosystem, the economic engine of the internet, is also a weapon of mass surveillance.

For the journalists at Al Jazeera, for the officials at the Pentagon and the IAEA, for the activists and dissidents whose devices were compromised, the answer cannot come soon enough. The ad is the weapon. And it is pointed at all of us.

Veritas Press Investigative Analysis
Independent journalism examining global affairs, power, diplomacy, and accountability.

Source: Veritas Press C.I.C. | Multi-News Agencies