- Israeli ad tech company Discover-Tech weaponized global digital ad infrastructure to silently track and deliver spyware to devices, targeting Al Jazeera journalists and others without requiring clicks.
- The operation, linked to blacklisted Israeli spyware developers Candiru and Intelos, generated 10 million daily ad impressions across 200,000 sites, using a system called Controlium to turn ad auctions into surveillance tools.
- The campaign peaked in April, heavily targeting Palestine (nearly 2% of all digital ad impressions), and also hit sensitive networks like the Armenian prime minister's office, international organizations and defense institutions.
- Researchers dubbed the new technique "AdFection," marking the first public technical evidence of spyware delivery through online ads without user interaction, with anti-interception measures and surgical micro-targeting.
- The findings highlight growing concerns over commercial spyware proliferation, the blurring line between advertising and state surveillance and the need for transparency in the ad tech industry, as Al Jazeera condemned the attacks as an "assault on press freedom."
An Israeli advertising technology company exploited the global digital ad infrastructure to track journalists and deliver spyware to their devices without requiring them to click a single link, according to investigations published Tuesday by two research teams. The findings, released by the University of Toronto's Citizen Lab and the New York-based ad security firm Confiant, reveal a sophisticated surveillance operation that targeted employees of Al Jazeera and other entities across multiple countries, marking what researchers described as a "weaponization of ad infrastructure."
The operation was conducted by Discover-Tech, an Israeli ad tech company. Over four months, the company generated roughly 10 million ad impressions daily across nearly 200,000 websites and mobile apps, harvesting device fingerprints, IP addresses, authentication tokens and cookies. While the precise start date of the campaign months ago remains unclear, the investigations detail a targeted effort that peaked sharply in April, particularly in the Palestinian territories.
"The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures and surgical micro-targeting," Confiant said in its findings.
The researchers said Discover-Tech used a system called Controlium to turn routine ad auctions into a surveillance tool. Devices belonging to staff at the international news network Al Jazeera were among those infected through malicious ad placements, which operated silently, without visible pop-ups or suspicious links. The Qatar-based media network condemned "the spyware attacks targeting a number of its staff," describing them as an "assault on press freedom" and called for those responsible to be held accountable.
How the targeting worked
Citizen Lab and Confiant linked the malicious activity to Israeli spyware developer Candiru, which has been blacklisted by the United States and rebranded as Integrity Labs and Israeli surveillance technology provider Intelos. The companies allegedly exploited ad inventory on major platforms, including Google, Russia's Yandex and the U.S. ad tech platform Beeswax to track targets and compromise consumer devices.
Researchers said Discover-Tech used the ad system to identify potential targets, monitor their activity and facilitate the compromise of their devices. Citizen Lab identified a group linked to Discover-Tech, dubbed "Dark Cartographer," which allegedly exploited vulnerabilities at mobile carriers and matched advertising IDs with phone numbers to track subscribers on a large scale.
The geographic data revealed sharp spikes in traffic that researchers said pointed to targeted intelligence-gathering operations rather than routine commercial advertising. Palestine was the most heavily targeted territory, where Discover-Tech accounted for nearly 2% of all digital ad impressions, peaking at around 10% on April 7. The activity also reached sensitive networks, including the Armenian prime minister's office, international organizations, courts, universities and defense institutions.
Investigators detected targeted connections to Candiru servers in nine countries, with Belgium accounting for 56% of recorded activity, followed by the UAE, Saudi Arabia, Bahrain, Mexico and Spain.
A new technique: "AdFection"
Confiant described the campaign as highly sophisticated, citing its anti-interception measures and precise targeting capabilities. Citizen Lab said the findings provided the first public technical evidence that spyware could be delivered through online ads without users clicking on anything, a technique researchers dubbed "AdFection."
The discovery comes amid growing international concern over the proliferation of commercial spyware and its use against journalists, activists and political figures. Israel has become a major hub for the surveillance technology industry, with companies like NSO Group – maker of Pegasus spyware – facing sanctions and legal challenges over similar allegations.
This week's findings echo warnings from earlier this year about the dangers of misinformation in shaping public opinion during conflict. The use of digital infrastructure to gather compromising information on influential figures worldwide, as described by BrightU.AI's Enoch, fits a pattern of sophisticated strategies employed by various entities to intercept sensitive data from users' traffic.
The investigations underscore the risks of information warfare in modern conflicts. By exploiting the same digital advertising systems that power much of the internet, companies like Discover-Tech can turn routine browsing into a vector for surveillance – without the target ever knowing they were exposed.
Al Jazeera has called for those responsible to be held accountable. The researchers said their work demonstrated the need for greater transparency and oversight in the advertising technology industry, which often operates without meaningful regulation.
The broader implications of this case extend beyond journalists in the Middle East. The technique described by Citizen Lab and Confiant could be applied to any target whose digital footprint can be tracked through cookies, device IDs or IP addresses. As the line between commercial advertising and state surveillance continues to blur, the findings serve as a cautionary tale about the vulnerabilities embedded in the global digital economy.
Watch the video below that talks about how Israel rules the world of cybersecurity.
This video is from the ArchiveGuy channel on Brighteon.com.
Sources include:
Please contact us for more information.