Israeli firm used ads to enable espionage, Canadian researchers say

An Israeli advertising agency has placed ads seen by millions of internet users that have left them open to spyware attacks, according to a new report from the University of Toronto's Citizen Lab.

Ads left millions open to 'zero-click' spyware attacks, Citizen Lab says

Listen to this article

Estimated 5 minutes

The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.

An Israeli advertising agency has placed ads seen by millions of internet users that have left them open to spyware attacks, according to a new report from the University of Toronto's Citizen Lab.

The report, released on Thursday, alleges that Discover-Tech intentionally operates a platform that allows its "partners to de-anonymize, fingerprint, and automatically infect devices" with spyware.

Those partners can then "push malicious content to individual targeted users alongside advertisements," it says.

Over a four-month period, Discover-Tech ads appeared on more than 120,000 websites and more than 75,000 apps in dozens of countries — endangering the security of "national-security-sensitive networks," such as government ministries, armed forces and multilateral organizations such as NATO, according to the report, which was released alongside an affiliated investigation by U.S. cybersecurity firm Confiant.

Ron Deibert, Citizen Lab's director, said the findings are a "worst-nightmare" scenario, with "two poorly regulated and highly abused industries" — targeted advertising and mercenary spyware — coming together.

"It's a recipe for disaster," Deibert told CBC News. "It's global espionage that we've uncovered on a massive scale."

'Zero-click' attacks

Rights groups have raised concerns for years about companies that sell spyware to anyone, oppressive governments in particular, wishing to spy on the public, journalists, political figures and other perceived critics.

Experts also have speculated that what's known as the targeted ad ecosystem — where data brokers and advertising firms bid in real time to place ads on apps and websites — could be used for espionage.

But Thursday's report marks the first time researchers have documented how "zero-click" spyware attacks can be enabled by targeted ads, Citizen Lab says.

"Zero-click" means that users don't need to click on a link or actively do anything for their devices to be targeted with spyware.

"The moment [the ad] is rendered, their device can be hacked, so there's really no defence against this, short of not using a smart phone or [not] connecting to the internet," Deibert said. Such infections can be hard to detect.

The report said some Discover-Tech ads also appeared on the websites of news outlets, including CBC, BBC and the New York Times. But Deibert says there's not much those organizations could have done to prevent it.

WATCH | Spyware and the OPP:

OPP may have secretly used controversial tech that can spy on citizens

March 20, 2025|

Duration

7:46

"It's just the advertising ecosystem working as intended," he said.

Discover-Tech did not respond to CBC News's requests for comment via a contact form on the company's website.

Chuck Thompson, the head of public affairs at CBC, said in an email that the public broadcaster's logs have "no trace of having delivered any ads," from Discover-Tech. CBC escalated to Google, which operates systems for ad sellers, "to verify and provide answers," he said.

Al Jazeera targeted

Citizen Lab said it was able to confirm a targeted spyware attack on Al Jazeera: At least 45 of the Qatar-based news outlet's devices were infected with spyware via Discover-Tech's ads in 2024 and 2025, the report said.

When spyware is implanted, the operator behind the hack can take control of the device. "They can turn on the camera, turn on the microphone, and track someone's geolocation, so it's kind of like God-like capabilities," Deibert said.

The researchers linked the zero-click attacks on Al Jazeera "with high confidence" to spyware from Candiru, an Israel-based firm that the report said has rebranded as Integrity Labs.

LISTEN | How spyware abusers can easily hack your phone:

Ideas53:59Spyware abusers can easily hack your phone and surveil you

In 2021, the U.S. Department of Commerce sanctioned Candiru "based on evidence that [it] developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."

CBC News could not immediately find a way to reach Candiru on Thursday. The Reuters news agency also said its attempts were not successful.

An Al Jazeera spokesperson condemned the targeting of its staff by such spyware as 'deliberate attack on journalists and on press freedom.' (Malak Harb/The Associated Press)

An Al Jazeera Media Network spokesperson told CBC News in an email that it "strongly condemns the targeting of our staff with mercenary spyware."

"This is a deliberate attack on journalists and on press freedom," the spokesperson said, adding that while Al Jazeera would not speculate on who deployed the spyware, it is calling for "a full, independent investigation to identify those responsible and hold them to account."

Push for investigations

Qing Tan, an associate professor at Athabasca University in Alberta, said the Citizen Lab report raises "very concerning" questions, including around personal privacy. "A majority of people don't realize this could happen to them, so this is a very big issue," he said.

Citizen Lab researchers said their findings should push ad vendors to "significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers."

They also called on regulators around the world to "investigate whether the rights of their citizens, as well as applicable privacy and security laws were violated."

• To censor the internet, 10 countries use Canadian filtering technology, researchers say

• Ontario police may have secretly used controversial Israeli spyware, report finds

• LISTEN

  Your phone could easily be tapped by spyware abusers: cybersecurity expert

The Office of the Privacy Commissioner of Canada did not immediately respond to emailed questions about whether it intends to investigate the report's allegations or take any immediate action.

A Google spokesperson told CBC News in an emailed statement that it blocked Discover-Tech from its ad platforms "for systematically violating" the company's policies, and that it has set up warnings "to help protect people if they navigate to websites linked to this group," they said.

IAB Europe, a European association that develops frameworks for digital marketing and the advertising ecosystem, also said Thursday that Discover-Tech was suspended from its list of global vendors for violating its terms.

ABOUT THE AUTHOR

Jillian Kestler-D'Amours is a senior writer at CBC based in Montreal. You can reach her at jillian.kestler-d.amours@cbc.ca.