A shocking revelation has come to light regarding the digital security of people using mobile phones and computers. According to the investigation by Citizen Lab of the University of Toronto, an attempt was made to introduce spying malware into the device through advertisements related to Israeli company Discover Tech. The most worrying thing about this matter is that in some cases the user did not even need to click on the advertisement.
The investigation revealed advertisement records related to more than 1.20 lakh websites and more than 75 thousand apps. According to the report, the scope of these advertisements was not limited to common websites and mobile apps. It has also come to light that such advertisements are reaching the networks of the United Nations (UN), NATO and many government institutions. The names of apps like Truecaller, MX Player and Ludo Star used in India are also said to be included in the records related to the investigation. However, an app's name appearing in its advertising records does not mean that the app itself spied or that the phones of all its users were hacked.
What was the entire spy network?
Citizen Lab's investigation uncovered potential misuse of ad technology that could have been used to selectively target mobile phones and computers. In general, online advertising companies use many techniques to deliver advertisements to users. But according to the investigation, this system was misused to collect device information and potentially deliver spy software.
The report also mentions another group named 'Dark Cartographers'. This group is accused of trying to trace the mobile numbers of people in more than 30 countries through advertisements.
Understand in 6 points, how espionage could have happened through advertisements?
1. Made a medium for general advertisements
According to the investigation, seemingly normal online advertisements were used to carry out suspicious activities. When a user visits a website or app, advertisements may automatically load there.
In some cases the code associated with the ad may reach the device even without clicking on it. However, the loading of the code does not in itself prove that the device is hacked or has spy software installed on it.
2. Attempt to collect device and user information
Some information related to the device and its use can be collected through advertising technology. These may include technical identification of the device, IP address or information related to the apps and websites used by the user.
Such information can be used to identify potential targets. This can help ad networks differentiate between different devices and target specific users.
3. Attempt to deliver malware to selected devices
According to the method revealed in the investigation, an attempt could have been made to target some devices on the basis of information collected earlier. After this, attempts were made to deliver spy software to those devices through advertising related technology.
This type of activity is considered a serious cybersecurity threat because a user may see a generic ad without being aware of the technical process behind it. However, it is not necessary that every suspicious ad installs malware.
4. Advertising network reaches 161 countries
According to the report, the scope of advertising activities related to Discover Tech extended to 161 countries. Investigators found records related to more than 36.4 lakh potential users between January and June 2026 on one of the company's servers.
These data reflect records related to ad networks and potential targets. These cannot be directly considered as the number of victims of hacked mobile phones, infected computers or espionage.
According to investigators, the actual reach of this network may be wider than the records revealed.
5. Why could it be difficult to catch a spy?
Such activities can be difficult to identify because the advertisements appear generic and the technical process behind them is invisible to the user.
Additionally, if different devices are served different codes or ads, it may be more challenging for security experts to identify and analyze suspicious activity.
This is why cyber security experts consider it important to monitor ad networks, apps and websites as well as device security.
6. What did Google do after the disclosure?
According to the report, Discover Tech was included in Google's list of certified advertising companies since the year 2020. After Citizen Lab's investigation, Google removed the company from the list.
This action raises important questions about the security and authentication system of ad networks. However, removing a company from the certified list does not mean that the devices of all users who viewed its ads were infected.
Advertisements reached BBC, New York Times and government networks
The investigation also revealed records of suspicious advertisements appearing on the networks of many big media websites and institutions. Websites like BBC, New York Times, Fox News, CBC and Yahoo have been mentioned in these.
Apart from this, the report also revealed that advertisements reached the networks of the US Department of Defense, the Swedish Armed Forces and the Norwegian Police. Networks involving the International Atomic Energy Agency (IAEA) and the International Criminal Court (ICC) are also mentioned.
The seriousness of the matter has further increased when records of such advertisements reaching the networks of government offices and election monitoring organizations of many countries have been found. However, it is important to understand the difference between seeing ads on these networks and successfully breaking into the systems in place.
What precautions should Indian mobile users take?
After this revelation, it becomes even more important for mobile users to pay attention to digital security. Simply not clicking on an ad does not guarantee sufficient protection, as some cyberattacks may try to interfere with ad loading or exploit device vulnerabilities.
Take these steps to stay safe:
-
Keep phone updated: Install security updates for Android, iOS, and computer operating systems in a timely manner.
-
Download the app from trusted source: Avoid downloading APK or other files from unknown websites.
-
Check the permissions of suspicious apps: Grant camera, microphone, location, and other sensitive permissions only as needed.
-
Do not ignore safety warnings: Investigate the phone if it sees suspicious activity or security alerts.
-
Beware of unknown links and files: Do not enter personal information on suspicious websites and do not install unknown files.
The biggest question: Was your phone also spied on?
At this time, the advertising records uncovered in this investigation cannot be directly interpreted as the number of infected devices or affected users. Even having the names of apps like Truecaller, MX Player and Ludo Star in the records does not in itself prove that all their users have been spied on.
The most important aspect of this matter is that online advertising system can be used not only for promotion but also as a medium for possible cyber attacks. That's why security audits of apps and websites, accountability of ad networks, and security of users' devices are more important than ever.