Israeli advertising firm Discover-Tech has been blocked by major platforms like Google and Comcast following reports of a global mass surveillance operation. Cybersecurity researchers found the company used malicious advertisements to track users and distribute spyware. This incident highlights growing concerns over security vulnerabilities in the real-time online advertising ecosystem.
Cybersecurity investigators have uncovered a surveillance operation run by Israeli digital advertising firm Discover-Tech. The firm is accused of using online ads to track millions of users and deploy spyware. The discovery has led major advertising platforms, including Google, to cut ties with the company, raising concerns about the security of the online advertising industry.
Researchers from Citizen Lab and Confiant found that Discover-Tech used a method known as malvertising. By injecting malicious code into standard consumer goods ads, the firm could track users across over 120,000 websites and 75,000 mobile applications. This tracking often continued even after users left the original websites where the ads were loaded, a technique enabled by cookie matching.
The operation was not limited to individual consumer tracking. Reports indicate that malicious advertisements were detected on networks belonging to high-profile institutions, such as the U.S. Pentagon, the International Atomic Energy Agency, and the International Criminal Court. Additionally, dozens of devices at the media outlet Al Jazeera were reportedly compromised. Internal networks at technology companies, including Nvidia, Broadcom, and Micron, were also found to be impacted by these scripts.
Connections to Blacklisted Vendors
The investigation linked Discover-Tech’s activities to Candiru, an Israeli company already placed on a U.S. government blacklist for creating surveillance tools. This connection has intensified the scrutiny of Discover-Tech’s practices, as Candiru’s tools are restricted from being sold or used by U.S. entities due to human rights concerns.
Major industry players acted quickly to mitigate risk. Google removed Discover-Tech from its ad networks, citing policy breaches, while Comcast’s advertising subsidiary, Beeswax, terminated the firm’s access. IAB Europe, an industry body, also suspended the company from its list of approved vendors.
Investor and Industry Implications
This incident exposes a structural risk within the real-time bidding (RTB) infrastructure of online advertising. In this system, personal data is often shared across thousands of companies in milliseconds to serve ads. Because the supply chain is highly automated and complex, it is notoriously difficult to audit every vendor for security compliance.
Investors may monitor how ad-tech companies tighten security protocols and vendor vetting processes. With regulators globally focusing on data privacy, companies that fail to secure their ad supply chains may face reputational damage, loss of business from major platforms, and increased regulatory pressure. The shift away from unregulated third-party data tracking suggests that companies investing in secure, first-party data strategies may be better positioned for long-term stability.