Discover-Tech linked to ad-based spyware campaign, researchers say

Israeli advertising technology company Discover-Tech used online ad infrastructure to track targets and help deliver spyware to dozens of devices belonging to Al Jazeera staff and people at other entities, according to findings by Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.

RT reported the findings on October 17, describing an alleged operation that used advertising placements to identify potential targets, monitor their activity and facilitate device compromises. The findings are attributed to the two research teams; BharatVox has not independently verified their technical evidence.

Spyware delivery without a click

The researchers described advertising infrastructure being repurposed for several stages of surveillance, from selecting targets to delivering malicious software. Confiant highlighted highly precise targeting and technical measures designed to prevent interception of the operation.

Citizen Lab said the investigation supplied the first public technical evidence of spyware delivery through online ads without a user clicking on them. The researchers called the technique “AdFection.”

Devices used by Al Jazeera employees were reportedly infected through malicious advertising placements that produced neither visible pop-ups nor suspicious links. The Qatar-based network condemned the targeting of its staff, called it an “assault on press freedom” and demanded accountability.

Links to spyware suppliers and advertising platforms

The investigation also linked the activity to Israeli spyware developer Candiru, which the report described as US-blacklisted and rebranded as Integrity Labs, and to Israeli surveillance technology provider Intelos.

The companies allegedly exploited advertising inventory on platforms including Google, Russia’s Yandex and US ad tech platform Beeswax. These are allegations of misuse of advertising infrastructure, not evidence that the platforms knowingly participated in surveillance.

The report did not include responses from Discover-Tech, Candiru or Intelos, or from the named advertising platforms.

Researchers identify concentrated geographic activity

Palestine was described as the most heavily targeted territory. Discover-Tech accounted for nearly 2% of all digital ad impressions there, with its share reaching about 10% on April 7. The report did not specify the year of that peak. Researchers interpreted sharp traffic surges as indications of targeted intelligence collection rather than ordinary commercial advertising.

The activity also reached sensitive networks, including the Armenian prime minister’s office, international organisations, courts, universities and defence institutions. Network reach does not, by itself, establish that every institution’s devices were infected.

Investigators detected targeted connections to Candiru servers in nine countries. Belgium represented 56% of the recorded activity, followed by the UAE, Saudi Arabia, Bahrain, Mexico and Spain. That measure concerns recorded connections, not a count of confirmed spyware infections.