Researchers say Israeli ad firm Discover-Tech delivered zero-click spyware through online ads

What happened

Security researchers say they have documented, for the first time, a zero-click hacking operation delivered through targeted online advertising. According to The Verge, a joint investigation by Citizen Lab and Confiant found that an Israeli ad tech company called Discover-Tech worked with spyware vendors to infect devices simply by displaying an ad — no click, download or other interaction from the victim required. NBC News reported the findings earlier.

The discovery is notable because zero-click attacks have previously been associated with sophisticated exploits delivered through messages or network connections, not with the everyday infrastructure of programmatic advertising.

An ad network repurposed as an attack pipeline

On its face, Discover-Tech presents itself as a run-of-the-mill online advertising agency. But the researchers describe it as something quite different: a channel through which hacking groups could place malicious ads across the web at scale.

The centerpiece, according to the investigation cited by The Verge, is a platform known as Controlium. It reportedly gives spyware partners the ability to profile and de-anonymize large numbers of people, fingerprint their devices, and then hit selected targets with zero-click attacks. An operator can purportedly choose a specific person for infection or surveillance using identifiers that already circulate freely within the advertising ecosystem: an IP address, a mobile advertising ID or a browser identifier.

In other words, the same data points the ad industry uses to decide which shoe advertisement to show a shopper can be used to single out that shopper for spyware implantation.

One of Discover-Tech's partners, the researchers say, is Candiru, an Israeli spyware company that has been blacklisted by the US government.

Al Jazeera in the crosshairs

The investigation shows the operation had real victims. According to The Verge, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, the Qatar-based news network, in 2024 and again in 2025. The researchers counted at least 45 devices at the outlet that were targeted over those two years.

The targeting of a news organization underscores the journalism-adjacent nature of mercenary spyware: reporters, their sources and their networks are frequently the intended victims of such tools.

Industry reaction and defenses

Citizen Lab and Confiant are urging the advertising industry to harden its platforms against this kind of abuse. Some steps have already been taken: The Verge reports, citing Reuters, that Google and Beeswax, an advertising company owned by Comcast, have removed Discover-Tech from their platforms. IAB Europe has also suspended the company from its list of approved vendors.

For individuals at elevated risk of being targeted, the researchers recommend practical mitigations: use ad blockers, disable ad tracking where possible, and reset mobile advertising IDs on a regular basis so that persistent identifiers are less useful for profiling.

Why it matters

This findings connect two worlds that have usually been discussed separately: the commercial surveillance apparatus of ad tech and the mercenary spyware industry. The ad ecosystem's design — built to identify, profile and reach specific individuals across millions of websites — turns out to be a capable targeting and delivery system for attackers, and it sits in front of a vast number of internet users every day.

The incident also shows how little visibility exists into who is allowed to buy and serve ads. Discover-Tech operated as an approved vendor within industry frameworks until researchers exposed its alleged dual use, which suggests the vetting processes behind programmatic advertising are not designed to catch this threat class.

For news organizations, human rights workers and other high-risk groups, the lesson is starker: merely loading a web page with ads on it may, in some circumstances, be enough to compromise a device. Until ad platforms adopt far stronger security guarantees, the researchers' advice — blocking ads, limiting tracking and rotating ad identifiers — is the main line of defense available to ordinary users.