Citizen Lab: Israeli ad firm's platform delivered zero-click spyware through millions of ads

How the campaign works

The Guardian reports that an Israeli digital advertising company, Discover-Tech, has been serving millions of online adverts that double as a delivery mechanism for zero-click mercenary spyware. The findings come from Citizen Lab, the digital investigations unit at the University of Toronto, which says it believes dozens of devices at the Qatari broadcaster Al Jazeera were compromised through ads run by the firm.

At the centre of the operation is a platform called Controlium, which Discover-Tech operates. Citizen Lab describes it as a system that lets clients mass-profile and deanonymise internet users, then covertly hand selected targets to third-party spyware vendors.

Zero-click delivery through advertising

Conventional spyware campaigns usually depend on a victim clicking a link or opening an attachment. According to Citizen Lab, this one requires no interaction at all. When a person is shown a seemingly harmless advert — for a mobile game or a telecoms service, for instance — Controlium can harvest their identity and IP address in that instant. If that person has been flagged as a target, a mercenary spyware firm then transmits malicious code to the device, which is infected within seconds and without the user's knowledge.

Bill Marczak, a Citizen Lab researcher, said there had long been speculation that online advertising could be used to identify and automatically hack specific individuals with precision, but that this is the first time concrete technical evidence has documented the process in action.

Scale and targets

Millions of users worldwide have reportedly been served Discover-Tech adverts since 2024, including in Yemen, Brazil, Mexico and Czechia. Related work by the research group Confiant suggests the ads were also displayed to people on the networks of government entities in Europe and the United States, as well as the UN, Nato, the International Criminal Court and the International Atomic Energy Agency.

Citizen Lab says Controlium acts as a facilitator for spyware firms that have gone after government officials, journalists, businesspeople, activists, academics and embassy workers. Once implanted, the spyware described in the report can pull messages, photos and emails off a device, record calls and secretly activate its microphone. The Guardian notes that the full extent of the targeting is unknown and that Discover-Tech had been approached for comment.

A systemic problem in ad tech

The findings land in a market with little regulation. When someone loads a web page, their profile — device details and data compiled through cross-site tracking — is broadcast into a split-second automated auction involving dozens or hundreds of companies. That same machinery, the researchers argue, has now been shown to work as a surveillance and attack pipeline.

Wolfie Christl, a Citizen Lab researcher, said it was disastrous that major advertising vendors and organisations were apparently unable to detect or prevent the malicious operations for years, and that the online advertising ecosystem as it works today is a security threat to states, the private sector and civil society alike. He called on cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions to investigate the companies involved and address the systemic risks.

Other reporting points in the same direction. Reuters has reported that billions of dollars of Meta's ad revenue derives from ads for scams, illegal gambling and other banned content, while in the US, government agencies including ICE have bought software that uses ad tech data to track people's movements.

Why it matters

This is the first documented case of the programmatic advertising infrastructure being weaponised end to end: profiling at scale, deanonymising individuals and delivering mercenary spyware without a single click. It invalidates the standard advice of avoiding suspicious links, because the attack surface is now the ads themselves — a channel nearly every internet user, including staff at the UN, Nato and the ICC, is exposed to daily. For newsrooms, diplomats and human rights organisations, it means adversaries can reach them through ordinary browsing on otherwise legitimate sites. The report shifts the burden squarely onto ad exchanges, vendors and regulators to detect and block malicious actors inside an ecosystem built for speed and opacity rather than accountability.