Israeli ad firm Discover-Tech accused of spying on phones through ads that spy on load

A fresh attack on the privacy of internet and smartphone users has come to light. The ordinary advertisements people see every day while using websites or mobile apps have become a dangerous tool for spying, the disclosure says.

Canadian cyber research group Citizen Lab and New York-based ad security company Confiant released separate reports on Thursday. They expose what they describe as an international scheme by Israeli digital advertising company Discover-Tech.

According to the researchers, Discover-Tech misused the advertising networks of major technology companies such as Google, Comcast and Russia's Yandex. Through them, the company spread its ads across more than 120,000 websites and 75,000 mobile apps. The ads carried attractive images of mobile phones, earbuds and everyday electronic goods.

The researchers say the ads were not meant only for display. They were built to track a user's digital location, IP address and personal identity.

The most alarming aspect of the attack is that no one needed to click a link. In technical terms it is called a zero-click or AdFection attack. If a user opened a website or app and the ad merely loaded on the screen, data collection and spying began automatically in the background. In some cases, attempts were also made to obtain users' phone numbers and break into their devices.

The ad network has been directly linked to Candiru, a controversial Israeli spyware maker. The United States banned Candiru in 2021.

According to Citizen Lab, between 2024 and 2025 Candiru's spyware was installed on all 45 Windows computers of Qatar-based news channel Al Jazeera through Discover-Tech's ads.

Following the disclosure, Google and other major ad network platforms have begun action to ban Discover-Tech.