Citizen Lab and Confiant released a detailed report Thursday that traced how Discover‑Tech’s network of more than 120,000 sites and 75,000 apps was exploited to deliver malicious code. The ads, often disguised as ordinary product promotions, were served to users worldwide, with the platform’s cookie‑matching system allowing the firm to stitch together browsing histories across different sites. According to research, Discover‑Tech pumped out at least 10 million ads a day – a volume that could potentially reach hundreds of millions of users.
The spyware, branded Candiru, was tied to every ad that carried a hidden payload. In a separate audit, Citizen Lab confirmed that 45 Windows devices at Qatar’s Al Jazeera were infected between 2024 and 2025 after users clicked on a Discover‑Tech ad. “The ads were found on networks as sensitive as the Pentagon, the International Atomic Energy Agency and the International Criminal Court,” said Jerome Dangu, Confiant co‑founder. Dangu added that the firm’s reach was especially dense in the Palestinian territories, where a single user could encounter a Discover‑Tech ad on almost any website.
In response, Google announced that it had removed Discover‑Tech from its ad services after finding systematic policy violations. IAB Europe suspended the firm from its list of globally approved vendors last week, and Comcast’s ad‑tech arm, Beeswax, followed suit. The company has yet to reply to inquiries from Reuters, and its chief executive, Dekel Boni, remains unresponsive to emails and LinkedIn messages.
With the U.S. Commerce Department still blacklisting Candiru for its role in targeting officials and journalists, regulators are now scrutinizing Discover‑Tech’s partnerships with other ad platforms. Meanwhile, a former Al Jazeera security officer said the breach forced the news outlet to overhaul its device‑security protocols, a costly process that could take months to complete.