An Israeli digital advertising company used an extensive network of online advertisements to track internet users and help facilitate spyware attacks, including against Arab journalists, according to research by Citizen Lab and advertising security firm Confiant.

The two research groups said Discover-Tech provided access to advertising platforms operated by Google, Comcast, Russia’s Yandex and other companies to Israeli spyware firm Candiru and other surveillance vendors.

Their separate investigations found that Discover-Tech’s advertisements appeared across more than 120,000 websites and 75,000 applications through its various partnerships, according to Citizen Lab.

The ads often promoted ordinary consumer products, such as smartphones and earbuds, potentially allowing the tracking activity to blend into everyday online browsing. Researchers found that simply loading certain advertisements could enable Discover-Tech to identify and track users, while some ads attempted to collect phone numbers from smartphone users.

Parts of the advertising infrastructure were also used to help deliver Candiru spyware. Confiant stressed, however, that advertisements linked to spyware accounted for only a small proportion of Discover-Tech’s overall activity.

Confiant co-founder Jerome Dangu said Discover-Tech distributed at least 10 million advertisements globally each day. Agreements between companies to exchange tracking information, known as cookie matching, could further expand the network’s ability to follow users across websites.

“Very likely hundreds of millions of people would have been touched by Discover-Tech,” Dangu said.

The researchers identified Discover-Tech advertisements across networks considered particularly sensitive, including those associated with the Pentagon, the International Atomic Energy Agency (IAEA) and the International Criminal Court (ICC).

Citizen Lab also found the advertisements within networks belonging to the United Nations, NATO, the European Commission and more than a dozen national governments.

The Palestinian territories were among the areas with particularly high concentrations of the company’s advertisements, raising concerns about the extent to which the advertising network could monitor online activity across Palestinian society.

“You go to almost any site in Palestine, any site, you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country,” Dangu said.

Citizen Lab said it had identified evidence linking a powerful form of Candiru spyware delivered through Discover-Tech advertisements to the compromise of 45 Windows devices belonging to Arab journalists.

The researchers also identified Discover-Tech advertisements within networks associated with major technology companies, including Nvidia, SanDisk, Broadcom and Micron, as well as several unidentified media organizations in Mexico, occupied Palestine and Europe.

Citizen Lab said it had identified Candiru and other surveillance providers associated with the advertising network. Researchers also obtained information about possible user locations after Discover-Tech inadvertently exposed authentication logs online.

Several companies and industry organizations have taken action against Discover-Tech following the findings.

Google said it had worked with Citizen Lab and Confiant during the investigation and removed the company from its advertising platforms for “systematically violating our policies.”

IAB Europe said Discover-Tech had been suspended from its list of globally approved vendors the previous week after an audit found policy violations.

Comcast said its advertising technology subsidiary, Beeswax, had also removed Discover-Tech from its platform “following recent activity.”

Candiru was placed on a US Commerce Department blacklist in 2021 over allegations that its spyware had been used to target government officials, journalists, activists and academics.

The findings raise broader concerns about the potential misuse of digital advertising infrastructure to facilitate surveillance, particularly when advertisements reach sensitive government networks, media organizations and populations living under heightened political and security pressures. (ILKHA)