Online advertising infrastructure was used to identify people and deliver zero-click spyware to selected devices, according to researchers at the University of Toronto's Citizen Lab. The group said the technique compromised dozens of devices at broadcaster Al Jazeera without requiring victims to open a link or download a file.
The researchers linked the activity to Discover-Tech, an Israeli company that describes itself as a specialised digital advertising agency. Citizen Lab said Discover-Tech operates a platform called Controlium that can profile and deanonymise internet users, then facilitate attacks by third-party spyware vendors. Discover-Tech was approached for comment, according to The Guardian, but no response was included in the report.
The reported attack chain begins with the automated advertising auctions that take place when a website or app loads an advert. Those auctions circulate information about a device and its user among numerous intermediaries so advertisers can decide whether to bid for an impression. Citizen Lab said apparently ordinary ads created for campaigns such as games or telecom services were used to collect identifiers and IP addresses.
If an observed user had been selected for surveillance, malicious code could then be sent to the device within seconds, the researchers said. That made the delivery zero-click: the target did not need to interact with the advert. Once installed, the third-party spyware could potentially extract messages, photographs and email, record calls, or activate a microphone, according to the report.
Citizen Lab said Discover-Tech ads had reached millions of users since 2024 in countries including Yemen, Brazil, Mexico and Czechia. Separate research by security company Confiant indicated the ads also appeared on networks used by government bodies in Europe and the United States, as well as international institutions. The full number of people deliberately targeted or infected remains unknown.
The findings do not mean every person served one of the company's ads received spyware. The researchers describe a broad profiling layer followed by selective exploitation of chosen devices. They also characterize Controlium as a facilitator for separate surveillance vendors rather than the maker of every payload delivered through the system.
The investigation highlights a security risk built into programmatic advertising: information intended to select and measure ads can also help an attacker locate a particular device. Citizen Lab urged cybersecurity agencies, regulators and lawmakers to investigate the companies involved and address weaknesses that allow covert targeting through advertising systems.
The report adds a new dimension to longstanding privacy concerns about real-time bidding. Data moving through an advertising auction can expose enough information to distinguish devices and follow their activity. In this case, researchers say that capability became part of a delivery path for an invasive surveillance product, turning routine ad placement into a potential security event.
