Citizen Lab reported that these ads, which usually include the promotion of everyday products such as phones or headphones, have reached more than 120 thousand websites and more than 75 thousand mobile applications thanks to the established collaborations.
Security experts noted that the user does not need to click on the ad for the spying activity to occur, and that loading the ad on the website is sufficient to detect and track the device.
It was announced that the company tried to capture the phone numbers of smartphone users in some cases, and that some advertisements were used to infiltrate Candiru's spyware into devices.
Confiant co-founder Jerome Dangu told Reuters that Discover-Tech publishes at least 10 million ads a day worldwide and can track people beyond the reach limit of the ads thanks to data sharing methods called "cookie matching".
Dangu stated that it is very likely that Discover-Tech's activities have touched hundreds of millions of people.
It was reported that advertisements related to Candiru constitute a small part of the company's total advertising volume, but play a key role in targeted operations.
Research findings documented that malicious ads reached users within vulnerable organizations' internal networks.
Dangu noted that the ads were shown on hundreds of sensitive networks belonging to institutions such as the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
Emphasizing that advertisements are concentrated in some regions, Dangu pointed out the situation in the Palestinian territories and said, "In Palestine, almost no matter which site you enter, you encounter a Discover-Tech advertisement. This gives them complete visibility over the digital activities of an entire country."
Citizen Lab also announced that similar ad impressions were detected in the United Nations, NATO, the European Commission and government networks of more than 10 countries.
It was also found that the ads appeared on the networks of chip manufacturing companies such as Nvidia, Sandisk, Broadcom and Micron, and some media organizations operating in Mexico, Israel and Europe.
On the other hand, the report included information that Candiru spyware was used to infiltrate the systems of Qatar-based broadcaster Al Jazeera through Discover-Tech advertisements.
Citizen Lab, examining the network logs shared by the media organization, confirmed that 45 Windows-based devices within Al Jazeera were targeted between 2024 and 2025.
Researchers also determined that Discover-Tech systems were accessed from IP addresses in Israel, Europe and the Gulf region, thanks to the company leaving its authentication records open to the internet.
In addition, Citizen Lab researcher Wolfie Cristl evaluated, "The way online advertising works today poses a systemic security threat to governments, the private sector, civil society and everyone else."
Following the reports, technology and advertising companies began cutting ties with Discover-Tech.
Google stated that it cooperated with Citizen Lab and Confiant in the conduct of the research, and that it removed Discover-Tech from its advertising platforms on the grounds that it systematically violated company policies.
Europe-based digital marketing association IAB Europe announced that Discover-Tech's status on the global approved sellers list was suspended last week after an audit identified policy violations.
Beeswax, the advertising technology company within Comcast, also confirmed that it removed the company from its platform following the latest developments.
The US Department of Commerce blacklisted Candiru in 2021 on the grounds that it provided spyware to maliciously target government officials, journalists, activists and academics.
Earlier in the year, the Pentagon announced that it had received notifications that US soldiers in conflict zones were being targeted based on location data collected by advertising technology companies and data brokers, and military units disabled ad tracking on some devices.
While Discover-Tech and the company's CEO, Dekel Boni, did not respond to the messages sent to them, attempts to reach Candiru owners, Yandex and Al Jazeera officials were unsuccessful.
