Israeli ad firm enabled zero-click spyware through millions of ads, Citizen Lab says

Millions of online adverts served by an Israeli advertising agency have doubled as an installation channel for spyware that infects targets without a single click, researchers at the University of Toronto's Citizen Lab have found. Discover-Tech, the agency, operates a software platform called Controlium that lets clients "mass-profile and deanonymise" internet users and then covertly hack selected targets with third-party spyware. Citizen Lab believes dozens of devices at the Qatari broadcaster Al Jazeera were compromised through ads run by the firm.

The delivery route is the ad auction itself. When a user opens a website, their details enter a split-second programmatic auction in which dozens or hundreds of companies bid automatically to place an ad. Controlium harvested users' identities and IP addresses through seemingly benign custom-created ads — for a digital game or a telecoms service. For anyone selected as a target, a mercenary spyware firm then sent malicious code to the device; installation required no interaction, took seconds and happened without the victim's knowledge.

The spyware can take everything on a device — messages, photos and emails, recorded calls, microphones switched on in secret — and Controlium, in Citizen Lab's assessment, acts as a "facilitator" for third-party spyware firms whose targets have included government officials, journalists, businesspeople, activists, academics and embassy workers. Discover-Tech's ads have been served since 2024 to users in Yemen, Brazil, Mexico and Czechia. Related research by the group Confiant indicates they also reached users on the networks of government entities in Europe and the US, and of the UN, Nato, the International Criminal Court and the International Atomic Energy Agency.

Every link in that chain is paid to move fast, not to ask questions. Intermediaries take their percentage of each placement; no one bears the cost of what an ad actually does. The report describes an ecosystem "weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," and researcher Wolfie Christl called it "disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company's malicious advertising operations for years." Bill Marczak, another researcher on the project, said that while there had long been buzz that online ads could identify and automatically hack targets, "for the first time, we have concrete technical evidence showing this process in action."

The full extent of the targeting remains unknown, Citizen Lab says. Discover-Tech describes itself as a specialised digital advertising agency and was approached for comment.