An Israeli marketing firm has been accused of running advertisements that put millions of internet users at risk of spyware attacks, as per a recent study by the University of Toronto’s Citizen Lab.
The report, published on Thursday, asserts that Discover-Tech is knowingly operating a platform that enables its affiliates to identify individuals, track their online activities, and automatically infect their devices with spyware. These affiliates can then distribute harmful content to specific users in conjunction with advertisements.
Over a period of four months, Discover-Tech’s ads were displayed on over 120,000 websites and 75,000 apps across numerous countries, posing a threat to the security of sensitive networks like government agencies, military establishments, and international bodies such as NATO. The report was accompanied by a related investigation conducted by U.S. cybersecurity company Confiant.
Ron Deibert, the director of Citizen Lab, described the findings as a “nightmarish” scenario, highlighting the convergence of unregulated targeted advertising and unethical spyware practices on a global scale.
Concerns have been raised by advocacy groups for years regarding firms selling spyware to authoritarian governments seeking to surveil the public, journalists, and dissidents. The report indicates that the targeted advertising ecosystem, where data brokers and marketing agencies bid in real-time to place ads, could be exploited for espionage purposes.
This report is the first to document how “zero-click” spyware attacks can be facilitated through targeted ads, according to Citizen Lab. In such attacks, users do not need to interact with the ad or click on any links for their devices to be compromised by spyware.
Deibert emphasized the severe implications of these attacks, stating that once the ad is loaded, the device may be infiltrated without the user’s knowledge, making detection challenging. The report disclosed that Discover-Tech’s ads also appeared on reputable news websites like CBC, BBC, and the New York Times, with little recourse for these organizations to prevent such occurrences.
Discover-Tech has not responded to requests for comment from CBC News, and the public broadcaster has escalated the matter to Google for verification and resolution.
Al Jazeera was specifically targeted in a spyware attack, with at least 45 devices belonging to the news outlet reportedly infected through Discover-Tech’s ads between 2024 and 2025. The spyware grants the attacker extensive control over the compromised device, enabling activities like activating the camera, microphone, and tracking the user’s location.
The researchers linked the zero-click attacks on Al Jazeera to spyware developed by Candiru, an Israeli firm that has rebranded as Integrity Labs. Candiru was sanctioned by the U.S. Department of Commerce in 2021 for supplying spyware to foreign governments for malicious purposes.
Al Jazeera strongly condemned the use of spyware against its staff, labeling it as a deliberate assault on journalists and press freedom. The network called for an independent investigation to identify and hold the perpetrators accountable.
Experts and researchers have urged advertising vendors to enhance their cybersecurity measures to combat malicious advertisers effectively. They also called on global regulators to investigate potential violations of citizens’ rights, privacy laws, and security standards.
The Office of the Privacy Commissioner of Canada and other relevant authorities have been called upon to address the report’s allegations and take appropriate actions. Google confirmed blocking Discover-Tech from its ad platforms due to policy violations and implemented warnings to safeguard users from associated websites. Additionally, IAB Europe suspended Discover-Tech from its list of vendors for breaching its terms.
