TEHRAN — An Israeli advertising company turned the banner ad into a hacking tool, and for at least two years the companies running the world’s ad platforms failed to stop it.

Two investigations published October 15, by Citizen Lab at the University of Toronto and the New York security firm Confiant, describe how Discover-Tech, founded in 2020, let surveillance vendors identify internet users and infect chosen ones without a single click.

The company’s platform, Controlium, profiled users in bulk and stripped away their anonymity. Citizen Lab calls the technique AdFection. A person opens a website or app, and dozens of firms bid in milliseconds for the ad slot. If Discover-Tech wins, it learns who is looking. If that person is on a client’s list, spyware can follow within seconds.

The ads sold phones, earbuds, games and telecom plans. Nothing about them looked wrong. They only had to load.

Citizen Lab examined roughly four billion ad records and found Discover-Tech material on more than 120,000 websites and 75,000 apps.

Confiant counted at least 10 million ads a day. Through cookie matching, its cofounder Jerome Dangu said, the firm could track people beyond its own ads. “Very likely hundreds of millions of people would have been touched by Discover-Tech,” he said.

Al Jazeera in the crosshairs

The best-documented victims worked for Al Jazeera. Between 2024 and 2025, 45 Windows computers at the Qatari broadcaster were infected with spyware from Candiru, the Israeli vendor the U.S. Commerce Department blacklisted in 2021 over its use against officials, journalists, activists and academics.

Al Jazeera’s own technicians had spotted strange activity and brought in Citizen Lab, which confirmed the attack from the network’s logs.

The implant can read files, emails and messages, log keystrokes, take screenshots and switch on microphones and cameras. It is understood to have cost several million dollars.

Al Jazeera called it an assault on press freedom and demanded accountability. It has been here before. In 2020, Citizen Lab found that 36 phones belonging to the network’s journalists and executives had been hacked with Pegasus, made by another Israeli firm, NSO Group.

A whole population under watch

Dangu said the Palestinian territories were especially saturated. Almost any site there carried a Discover-Tech ad, he said, giving the firm “a very complete visibility on the digital activities of an entire country.”

Israel already controls movement, borders and much of daily life in the occupied territories. This added a layer inside the browser.

The same ads appeared in networks tied to the Pentagon, the International Atomic Energy Agency, the United Nations, NATO, the European Commission and more than a dozen national governments, along with chipmakers such as Nvidia, Broadcom and Micron.

They also reached the International Criminal Court, which issued arrest warrants for Benjamin Netanyahu and Yoav Gallant in 2024.

Platforms act late

Google says it removed Discover-Tech “for systematically violating our policies.” Europe’s Interactive Advertising Bureau (IAB) suspended the firm last week after an audit, and Comcast’s Beeswax dropped it.

Yandex did not comment. Discover-Tech and Candiru’s owners did not answer Reuters. Confiant noted that ads it tied to Candiru were a tiny fraction of the volume.

Citizen Lab’s Wolfie Christl called it disastrous that major vendors missed the operation for years, and urged U.S. and European regulators to investigate.

Candiru has been on a U.S. blacklist for five years. The pipeline that carried its code ran through American-owned platforms until outside researchers forced the issue.