Investigations published on Thursday by the University of Toronto’s Citizen Lab and advertising security company Confiant identified Discover-Tech as an intermediary connecting commercial surveillance operators with major digital advertising networks. The researchers documented spyware infections at Al Jazeera and surveillance activity across government, corporate and public networks.
Citizen Lab said Discover-Tech’s advertisements appeared on more than 120,000 websites and 70,000 mobile applications between March and June 2026. Its analysis of nearly four billion advertising bidding records showed that millions of devices were directed towards infrastructure associated with surveillance operations.
Confiant co-founder Jerome Dangu estimated that hundreds of millions of people were likely exposed to Discover-Tech’s activities. The figure represents potential exposure to advertising-based tracking, rather than confirmed spyware infections, which researchers established in a much smaller number of cases.
Google said it had removed Discover-Tech from its advertising platforms for systematically violating company policies. IAB Europe, an advertising industry association, also suspended the company from its approved vendor list following an audit that identified policy breaches.
The investigation established that Discover-Tech provided advertising access to Candiru, an Israeli surveillance software developer placed on a United States government trade blacklist. Other surveillance businesses were also linked to the operation, according to Citizen Lab.
Researchers identified a technique they named AdFection, through which targeted advertisements could trigger surveillance activity without requiring users to click anything. An advertisement merely appearing within a website or application could initiate contact with servers used to profile a device or deliver malicious software.
Citizen Lab said Discover-Tech operated a platform called Controlium that allowed surveillance customers to identify individuals, associate separate digital identifiers with particular users and select devices for exploitation. Information available through advertising exchanges could include network addresses, device identifiers and details useful for identifying targets.
The most concrete evidence of successful hacking involved Al Jazeera. Citizen Lab established that 45 Windows devices associated with the Qatar-based broadcaster were compromised by Candiru spyware between 2024 and 2025, after examining network records supplied by the organisation.
Al Jazeera condemned the attacks against its staff and said it was taking measures to protect employees and computer systems. The broadcaster called for those responsible to be held accountable.
The researchers stressed that displaying a Discover-Tech advertisement did not necessarily mean a device had been infected. Some advertisements enabled profiling or reconnaissance, while a smaller subset was associated with attempts to install spyware.
Advertising records nevertheless showed exposure across sensitive networks, including those associated with NATO, the United Nations, the European Commission and national governments. Confiant also identified advertising activity involving networks linked to the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
Those findings establish the reach of the advertising operation, not that the institutions themselves suffered successful intrusions. Researchers said additional investigation would be necessary to determine whether individual devices on those networks had been compromised.
Dangu said Discover-Tech distributed at least 10 million advertisements daily and could extend its tracking reach through arrangements that match identifiers across advertising services. He identified particularly advertising activity in the Palestinian territories.
The advertisements often resembled conventional promotions for consumer products, including mobile phones and earphones. Their appearance within familiar websites and applications helped disguise surveillance functions from users who had no reason to suspect an advertisement could be part of a hacking operation.
Citizen Lab said its findings constituted the first public technical confirmation of commercial spyware being delivered through targeted advertisements without user interaction. The researchers argued that the advertising system’s routine exchange of detailed device information created opportunities for surveillance beyond conventional marketing.
Citizen Lab examined advertising records that had been accessible through databases operated by Discover-Tech. Those records covered a four-month period and did not capture every advertising arrangement used by the company. Researchers said the available evidence therefore could not establish the full geographical reach of the operation or the total number of people whose devices were profiled.
The investigation also found Discover-Tech advertisements appearing in everyday applications, including messaging, weather and dating services. Citizen Lab said the company’s activity spanned dozens of countries and numerous advertising exchanges, demonstrating how advertising placements could provide access to users across unrelated online services.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
