How an Israeli advertising company connected online advertising to mercenary spyware, and helped turn everyday browsing into an opportunity for covert intrusion.
No suspicious link. No unfamiliar application to download. Simply opening a webpage and letting an advertisement load can be enough to trigger a spyware attack, without a single click..
This could be one of the most consequential surveillance scandals of the year. At its centre is Discover-Tech, an Israeli company that presented itself as a legitimate advertising business while facilitating operations for mercenary spyware vendors, according to Citizen Lab.
On October 15, 2026, the University of Toronto research group published what it describes as the first public technical confirmation of mercenary spyware delivered through targeted advertisements in actual attacks. Researchers call the technique AdFection. Their investigation connected Discover-Tech’s advertising infrastructure to spyware infections at Al Jazeera.
The company has identifiable owners and a documented corporate history. According to Israeli corporate records examined by Citizen Lab, as of July 2026, Discover-Tech was owned by Dekel Boni, Yaniv Basil, and Guy Lants. Boni was its CEO and sole director. The company was incorporated in March 2020 with Boni as its initial sole shareholder, before its ownership expanded.
Its connections to the surveillance industry also deserve attention. Eric Banoun, a prominent figure in Israeli surveillance technology, served on Discover-Tech’s board from 2020 until January 2025. Former shareholders included Chaia Services Ltd, which ceased holding shares in March 2026. Citizen Lab documented links between that company and the corporate network surrounding spyware group Intellexa.
Discover-Tech was the bridge between the advertising market and the surveillance operation.
To understand how, think of the advertising space on a website as a tiny digital billboard. When you open the page, companies can compete to rent that billboard for the moment you are looking at it. The auction happens automatically, usually before you notice the page has finished loading.
To help bidders decide whether they want to reach you, the advertising system shares information about your device. This can include an advertising identifier, your IP address, your approximate location, and details about your phone or computer. Those details help advertisers recognize the device visiting the page.
For an ordinary advertiser, that recognition helps sell a product. For a surveillance operator, it can help locate a target.
Discover-Tech operated Controlium, a platform that worked like a targeting dashboard. Customers could select devices using mobile advertising identifiers, browser identifiers, or IP addresses, and arrange advertisements carrying code intended to profile or attack those devices. Controlium was part of Discover-Tech’s operation, providing surveillance customers with an interface for reaching selected users through advertising.
When one of those advertisements loaded, hidden code contacted Discover-Tech’s server with identifying information. The server effectively checked: “Is this the device we are looking for?”
If the device was not selected, it could receive an empty response. If it matched the targeting conditions, it could receive additional code leading into the spyware delivery process. This selective response helped conceal the operation from advertising companies and security checks examining other devices.
The advertisement could therefore become a checkpoint: identify the device, assess the target, and decide what to deliver next.
The victim did not have to click. Loading the advertisement could start the attack.
Confiant’s parallel investigation documented sophisticated fingerprinting, encrypted communications, and concealment mechanisms. Its researchers also found aggressive collection of accessible first-party cookies in certain advertising contexts, including sensitive session information. These findings describe deliberate engineering: capabilities built to recognize devices, receive instructions, and obscure the operation from scrutiny.
Discover-Tech helped turn anonymous users into identifiable targets. According to Citizen Lab, Controlium enabled surveillance partners to de-anonymize users, fingerprint their devices, and target them for spyware delivery through advertisements. The same infrastructure that helped identify a target could become the route into that target’s device.
There is a bitter irony in the wider industry: Israeli-linked businesses also sell privacy. Kape, owned by Israeli businessman Teddy Sagi, acquired ExpressVPN. The companies are separate, but the contrast is striking: privacy sold as protection, while Discover-Tech facilitated covert intrusion.
Israel’s access to sophisticated intelligence technology is openly documented. In January 2024, American company Palantir entered a strategic partnership with Israel’s Ministry of Defense to support war-related missions. Bloomberg’s report describes Palantir’s Artificial Intelligence Platform as capable of analyzing enemy targets and proposing battle plans. The agreement illustrates the technological resources available to Israel’s defense establishment through international partnerships.
Discover-Tech’s infrastructure enabled surveillance partners to identify users and facilitate covert access to selected devices. Who wanted that access, and what advantage did they seek?
The timing deserves scrutiny. Al Jazeera devices were targeted during 2024 and 2025, while the network was covering Israel’s war in Gaza. During that same period, Israeli authorities shut down its operations inside Israel and Israeli troops raided its Ramallah bureau. Against that backdrop, the exposure of an Israeli company facilitating spyware attacks, with its advertisements also reaching foreign government, military, media, and critical infrastructure networks, raises an unavoidable question: who commissioned these operations, and what were they seeking? Al Jazeera is a documented case, not the limit of the company’s reach
Access to a newsroom’s devices could expose sources, reveal unpublished investigations, and give an adversary information useful for intimidation or disruption. Was the objective to gather intelligence alone, or could that intelligence have served a broader effort to undermine critical reporting? The evidence demands that investigators pursue that question. Identifying the customer, the information sought, and how any stolen material was used would help distinguish espionage from a wider campaign against the people producing that reporting.
At least 45 Al Jazeera devices were targeted during those two years. The operation’s advertising reach extended far beyond that newsroom: records showed Discover-Tech placements across approximately 75,000 mobile applications and 121,000 websites during March–June 2026. Those figures measure advertising reach, rather than confirmed infections, but they demonstrate the scale of the distribution infrastructure.
Discover-Tech advertisements also appeared on networks associated with government ministries, security agencies, other media organizations, NATO, and the United Nations. An advertisement appearing on a network does not establish that a device there was infected. It does establish that the company’s advertising reached institutions holding information of obvious intelligence value.
Following the investigation, Google blocked Discover-Tech from its advertising platforms. Other advertising organizations also restricted or removed its access. But cutting off one operator leaves a larger vulnerability exposed: the everyday advertising infrastructure it used to reach its targets remains woven into our digital lives.
The more of our lives we digitize, the more we expose to intrusion. Our money, work, conversations, and essential services depend on connected systems. A compromised device can become an entry point to much more than the information on its screen.
Discover-Tech exposed how little a target may need to do: simply browse a page while an advertisement loads. No suspicious download. No click granting access. The attack can begin during an entirely ordinary moment online.
The same technology industry that builds these systems also supplies the advertising infrastructure attackers exploit. Platforms sell precise access to users; surveillance companies turn that access into an opportunity for intrusion. The machinery built to reach us can also be used to compromise us.
That Discover-Tech emerged from Israel, a country renowned for its cybersecurity expertise—makes the case more unsettling. The technical sophistication described by researchers shows how expertise associated with protecting digital systems can also be used to penetrate them. For users dependent on those systems, that is hardly reassuring.
Beyond blocking Discover-Tech, Google introduced warnings for known malicious domains. But what prevents another operator from using the same route? What has changed to detect an advertisement that behaves innocently during inspection but delivers an attack to a selected device? Removing one company does not erase the capability it exploited.
As more of daily life moves online, the consequences grow: stolen access, exposed communications, disrupted work, and accounts placed beyond their owners’ control.
We are connecting everything while discovering how little interaction an attacker may need.
