An Israeli firm is sending spyware through online ads, researchers say
An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It's the first time researchers have found technical evidence of a zero-click attack - a form of hacking that requires no action by users - delivered through targeted advertising, as reported…
Key points
- Researchers say Israeli ad tech firm Discover-Tech used online ads to deliver zero-click spyware to devices.
- The investigation found Discover-Tech ads delivered Candiru-linked spyware to at least 45 Al Jazeera devices in 2024 and 2025.
- Google, Beeswax and IAB Europe removed or suspended Discover-Tech after the findings.
An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, simply by showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. The researchers said this is the first time they have found technical evidence of a zero-click attack delivered through targeted advertising, as reported earlier by NBC News.
The firm, Discover-Tech, presents itself as a typical online advertising agency but researchers say it provides a pipeline for hacking groups to plant malicious ads across the web. It operates a platform called Controlium that lets spyware partners profile and de-anonymize millions of people, fingerprint their devices, and target them with zero-click hacking, the investigation found.
Targeting and Al Jazeera
According to the investigation, Controlium allows partners to select a user for infection or profiling using an IP address, mobile ad ID, or browser identifier. One of the groups Discover-Tech works with is Candiru, an Israeli spyware company that has been blacklisted by the US government.
In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, a Qatar-based news network. Researchers say the companies targeted at least 45 devices at the news outlet in 2024 and 2025.
precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking
— Citizen Lab and Confiant investigation
Platform removals and advice
Citizen Lab and Confiant called on the advertising industry to ramp up security on their platforms. Google and the Comcast-owned advertising company Beeswax have since removed Discover-Tech from their platforms, while IAB Europe suspended the company from its list of approved vendors, Reuters reports.
Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.
