Israeli firm weaponized digital ad network for spyware attacks, research shows

Spread the love

This work by Middle East Monitor is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Illustration file picture shows a man typing on a computer keyboard [REUTERS/Kacper Pempel]

Israeli digital advertising firm Discover-Tech weaponized a vast commercial ad network to harvest personal data and deliver mercenary spyware to targeted devices worldwide, Canadian cyber watchdog Citizen Lab and New York-based ad security firm Confiant reported Thursday, Anadolu reports.

“The core finding is the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery, characterized by exceptional technical sophistication, robust anti-interception measures, and surgical micro-targeting,” Confiant said in its investigative findings.

The coordinated operation enabled US-blacklisted Israeli spyware company Candiru, rebranded as Integrity Labs, and surveillance vendor Intelos to exploit commercial ad inventory across major global platforms, including Google, Beeswax and Russia’s Yandex, to track targets and compromise consumer devices.

Citizen Lab described the campaign as the first public technical confirmation of zero-click mercenary spyware delivered through online advertising, a method researchers termed “AdFection.”

Devices belonging to staff at international news network Al Jazeera were among those infected through the weaponized ad placements, which operated silently without visible pop-ups or suspicious links.

– Global identity graph, data harvesting

Discover-Tech operated a specialized system called Controlium that converted routine commercial advertising auctions into an expansive surveillance apparatus. After analyzing 4 billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS in dozens of countries during a four-month period.

“Discover-Tech serves roughly 10 million ad impressions a day, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first-party cookies,” said Confiant.

READ: Gaza’s future is not Washington’s to decide, says rights chief

Investigators found that the ads routinely collected user session cookies, authenticated login tokens, and personal identifiers directly from publisher websites, exfiltrating the data even when European Union privacy regulations strictly barred processing without consent.

Citizen Lab also revealed that an affiliated threat actor, dubbed Dark Cartographer, utilized Discover-Tech’s infrastructure to exploit vulnerabilities across mobile telecom providers, matching digital advertising identities to physical phone numbers to deanonymize mobile subscribers en masse.

– Focus on Palestine, sensitive targets

Geographic telemetry revealed sharp traffic spikes pointing to deliberate intelligence operations rather than ordinary commercial advertising campaigns.

Palestine emerged as the most heavily targeted territory, where Discover-Tech served nearly 2% of all digital advertisements in the territory, peaking at roughly 10% on April 7, with one in every 36 Android ads originating from the firm.

Surveillance traffic also landed directly on sensitive administrative and institutional networks, including the Armenian Prime Minister’s Office, international bodies, judicial agencies, universities and defense organizations.

Investigators detected surgical handoffs to Candiru servers in nine countries, with Belgium accounting for 56% of observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain, and others.

After the joint investigation was disclosed, Google, the European advertising association IAB Europe, Beeswax, Vungle, and Eskimi severed Discover-Tech’s access to their digital advertising systems.

This work by Middle East Monitor is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Donald Trump sings and dances, says that it's fun to kill everyone ... unless he gets distracted or falls asleep. — Donald Trump sings and dances, says that it’s fun to kill everyone … unless he gets distracted or falls asleep.

Keir Starmer objects to criticism of the IDF. He asks how could anyone object to them starving people to death, forced marches like the Nazis did, bombing Gaza's hospitals and universities, mass-murdering journalists, healthworkers and starving people queuing for food, killing and raping prisoners and murdering children. He calls for people to stop obstructing his genocide for Israel. New Labour UK Prime Minister Andy Burnham continues Labour party policy of active support and complicity in Israel's genocide. — Keir Starmer objects to criticism of the IDF. He asks how could anyone object to them starving people to death, forced marches like the Nazis did, bombing Gaza’s hospitals and universities, mass-murdering journalists, healthworkers and starving people queuing for food, killing and raping prisoners and murdering children. He calls for people to stop obstructing his genocide for Israel. New Labour UK Prime Minister Andy Burnham continues Labour party policy of active support and complicity in Israel’s genocide.

UK Prime Minister Andy Burnham admits to blatently lying and engaging in deception to become leader of the UK Labour Party and Prime Minister.

Ed Miliband says that he and the Labour Party are full of shit criminalising people holding signs as terrorists despite anything he says.

– Global identity graph, data harvesting

– Focus on Palestine, sensitive targets

Andy Burnham stands with Israel

Comments