(SeaPRwire) –
The old spyware playbook is dead. You no longer need a nation-state actor to manually compromise a target. All you need is a few lines of malicious code wrapped inside a banner ad, delivered through a supply chain the target trusted implicitly. Discover-Tech proved this. It built a surveillance apparatus disguised as an advertising platform, funneling user telemetry to firms like Candiru and Intelos. The infrastructure was not built for marketers. It was built for hunters.
The official story reads like any other programmatic ad-tech operation. A company buys inventory across hundreds of thousands of sites and apps. It collects behavioral signals. It sells targeted placement. But when TrendAI examined the actual bidding data, the facade cracked. In over 100 countries, Discover-Tech was the leading bidder for ad space aimed at Starlink users. It dominated Syria, Libya, Yemen, and South Sudan. It came in second in Afghanistan. And in Palestine, the single largest target, ad spend concentrated despite the population having severely limited access to Western goods and negligible purchasing power. Legitimate advertisers do not bid aggressively in markets where demand is effectively zero. The math only makes sense if the objective is not revenue. It is identification and geolocation.
The ownership DNA confirms what the bidding data implied. Eric Banoun, the firm’s director, co-founded Circles, an operation affiliated with the Pegasus developer NSO Group. He also built Senpai Technologies, selling surveillance software to governments in Angola, Indonesia, and Malaysia. He founded Intelos, which ran the same ad-based tracking methodology now linked to Discover-Tech. A Haaretz report noted Banoun attempted to sell Intelos technology to Israel’s Shin Bet. Sara Hamou, a shareholder through her holding company, is a former Intellexa manager sentenced to eight years for her role in the Predator spyware scandal in Greece. This is not a startup that accidentally hired people with surveillance experience. This is a firm assembled from the architecture of Israel’s defense-industrial surveillance complex.
And the results speak for themselves. Citizen Lab confirmed that Discover-Tech’s ad infrastructure was used to infect at least 45 Al Jazeera devices with Candiru spyware across 2024 and 2025. The infections required no user interaction. Candiru was founded by two IDF intelligence veterans and operates under Israeli defense export controls. The Israeli government has not been directly accused of ordering the Al Jazeera campaign, but the structural alignment is undeniable. Israel treats domestically developed spyware as a controlled defense export. Export licenses for Pegasus have historically been granted when sales advanced Israeli foreign policy objectives. Black Cube, BlackCore, and Paragon Solutions have all operated in ways that align with Israeli strategic interests regardless of whether they carried direct government contracts. The ecosystem functions as a deniable extension of state capability.
After Citizen Lab and Confiant published their investigations, the commercial pressure became immediate. Google, Beeswax, and Eskimi blocked Discover-Tech. Vungle suspended access pending review. IAB Europe removed the firm from its approved vendor list. Yet the company’s website remains live, still marketing itself as a tailored digital advertising agency. No public response has been issued.
What this reveals is not merely the existence of another spyware vendor. It reveals how surveillance infrastructure has fully absorbed into the commercial ad stack. The barrier to entry collapsed. Any firm with sufficient capital and the right connections can route telemetry through legitimate ad exchanges, target conflict-zone users via satellite internet, and hand cleaned profiles to operators with military-grade malware. The pipeline is industrial. The accountability is opaque. And the targets are anyone connected to a device.