The short version
- Citizen Lab reports that Discover-Tech’s Controlium software profiles millions of users via ads to facilitate zero-click spyware infections.
- The technique allows third-party spyware firms to hack targets silently, compromising devices in seconds without user interaction.
- Al Jazeera and various government entities are among the organizations reportedly targeted by this advertising-based espionage pipeline.
Researchers at Citizen Lab, a digital investigations unit at the University of Toronto, have uncovered a sophisticated espionage operation that weaponizes online advertising to deliver zero-click spyware. The report identifies an Israeli firm, Discover-Tech, as the operator of a software platform called Controlium, which allegedly enables clients to mass-profile internet users and covertly hack targets. This method represents a significant evolution in cyber-espionage, as it requires no interaction from the victim to install malicious code.
According to the findings, Discover-Tech serves millions of seemingly benign advertisements for products such as digital games or telecom services. When a user views one of these ads, Controlium harvests their identity and IP address. If the user has been pre-selected as a target by a mercenary spyware firm, the platform facilitates the delivery of malicious code to their device. The infection occurs silently and within seconds, bypassing traditional security measures that rely on detecting user clicks or file downloads.
The report highlights that dozens of devices at the Qatari broadcaster Al Jazeera were compromised using this technique. Citizen Lab states that the spyware delivered through these ads can access everything on a target’s device, including messages, photos, and emails. It also has the capability to record calls and secretly activate microphones, providing attackers with comprehensive surveillance capabilities.
The scope of the targeting extends beyond media organizations. Related work by the research group Confiant suggests that Discover-Tech’s ads have been shown to users on networks belonging to government entities in Europe and the United States. Additionally, the ads were served to users associated with international bodies such as the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency. The victims reportedly include government officials, journalists, businesspeople, activists, academics, and embassy workers.
Wolfie Christl, a researcher at Citizen Lab, described the situation as disastrous, noting that major ad vendors and organizations failed to detect or prevent these malicious operations for years. He emphasized that the current structure of the online advertising ecosystem poses a security threat to states, the private sector, civil society, and individuals alike. The ability to profile millions of users globally since 2024 underscores the scale of the vulnerability.
The term 'AdFection' has been used to describe this specific pipeline, highlighting how targeted advertising infrastructure was repurposed for espionage. Unlike previous zero-click exploits that often relied on complex software vulnerabilities in messaging apps or operating systems, this method leverages the widespread and trusted nature of digital ad networks. This makes detection particularly challenging, as the initial vector appears to be a standard commercial advertisement.
Discover-Tech describes itself as a specialized digital advertising agency. However, Citizen Lab’s investigation reveals that its Controlium platform acts as a facilitator for third-party spyware firms. These firms use the profiling data to identify high-value targets and execute hacks with precision. The report does not specify which mercenary spyware vendors were involved, but it confirms that the technology allows for the covert installation of advanced persistent threats.
The implications for digital privacy and security are profound. If advertising platforms can be used to deanonymize users and deliver malware without consent, the fundamental trust in online interactions is compromised. Organizations must now consider not only the content of ads but also the infrastructure serving them as potential vectors for cyber-attacks.
The full extent of the targeting enabled by Discover-Tech remains unknown. Citizen Lab’s findings join a growing body of evidence regarding the proliferation of mercenary spyware and the vulnerabilities inherent in global digital infrastructure. The report calls for greater scrutiny of ad tech companies and their data practices to prevent similar abuses in the future.
As the details of this operation emerge, it raises urgent questions about regulatory oversight and corporate responsibility in the advertising industry. The ability to silently infect devices through ads challenges existing security paradigms and necessitates new approaches to protecting digital privacy. Until these vulnerabilities are addressed, users and organizations remain at risk from sophisticated actors exploiting the very platforms designed to connect them with consumers.
Sources behind this briefing
Go to the original reporting
- The Guardian US↗Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
- Financial Times↗New ‘zero-click’ spyware hacked phones using targeted ads
- The Citizen Lab↗Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
- CyberScoop↗AdFection: How mercenary spyware invades victims’ devices through targeted advertising
