The short version
- Citizen Lab researchers identified Discover-Tech's Controlium software as a tool for mass-profiling and covert hacking.
- The system allegedly delivered zero-click spyware to targets including Al Jazeera staff and users of government networks in Europe and the US.
- Experts warn that the online advertising ecosystem is being weaponized at scale, posing security risks to states and civil society.
Researchers from the University of Toronto’s Citizen Lab have identified a sophisticated cyber espionage operation that leverages the global digital advertising infrastructure to install spyware on target devices. The investigation points to an Israeli firm, Discover-Tech, which describes itself as a specialized digital advertising agency, as the operator behind the campaign. According to the findings, the company utilized a software platform named Controlium to mass-profile internet users and subsequently hack specific targets using third-party mercenary spyware.
The method described by researchers represents a significant evolution in cyber threats because it relies on zero-click exploitation. Unlike traditional malware infections that require a victim to click a malicious link or download a file, this technique installs spyware silently and within seconds of the user viewing an advertisement. The ads themselves appear benign, often promoting digital games or telecommunications services, but they serve as vectors for harvesting user identities and IP addresses.
Once a user is profiled and identified as a target, the system facilitates the delivery of malicious code. Citizen Lab reports that this process allows third-party spyware firms to access nearly everything on the compromised device. The capabilities include extracting messages, photos, and emails, as well as recording calls and secretly activating microphones. The researchers emphasize that the infections occur without the user’s knowledge or interaction.
The scope of the operation appears extensive. Citizen Lab stated that millions of users worldwide have been served ads by Discover-Tech since 2024. The geographic reach includes Yemen, Brazil, Mexico, and Czechia. Additionally, related work by the research group Confiant suggests that these advertisements were displayed to users on networks belonging to government entities in Europe and the United States. High-profile international organizations, including the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency, were also among those whose network users were exposed.
A specific case highlighted in the report involves the Qatari broadcaster Al Jazeera. Researchers believe that dozens of devices at the organization were compromised through ads run by Discover-Tech. The targeting profile allegedly includes government officials, journalists, businesspeople, activists, academics, and embassy workers. This broad spectrum of targets suggests a systematic effort to monitor individuals across various sectors of society.
Wolfie Christl, a researcher at Citizen Lab, criticized the failure of major ad vendors and organizations to detect or prevent these malicious operations for years. He described the current state of the online advertising ecosystem as a security threat to states, the private sector, civil society, and individuals alike. The weaponization of ad networks allows for silent, large-scale profiling that bypasses traditional cybersecurity defenses designed to catch interactive threats.
The full extent of the targeting enabled by Discover-Tech remains unknown. While Citizen Lab has provided evidence of the mechanism and specific instances of compromise, the complete list of clients using Controlium and the total number of successfully hacked devices have not been fully disclosed. The report joins a growing body of evidence regarding the use of mercenary spyware in global surveillance operations.
The findings raise urgent questions about the security architecture of digital advertising platforms. If benign ads can be used to deanonymize users and deliver zero-click exploits, the implications for privacy and national security are profound. The research underscores a vulnerability where commercial infrastructure is repurposed for state-level espionage without immediate detection by the platforms hosting the advertisements.
As the details of this operation emerge, experts are calling for a reevaluation of how digital ad ecosystems manage security risks. The ability to profile millions of users and selectively infect targets with minimal effort represents a new frontier in cyber warfare. Until safeguards are implemented, the threat of silent, ad-based espionage remains a persistent danger to journalists, activists, and government officials worldwide.
The investigation by Citizen Lab and Confiant provides a clear technical pathway for how these attacks occur, but it leaves open questions about accountability and remediation. Discover-Tech has not issued a public response detailed in the provided sources, and the long-term impact on the compromised individuals and organizations is still being assessed. The report serves as a warning that the digital advertising industry may be an unwitting accomplice in global surveillance campaigns.
Sources behind this briefing
Go to the original reporting
- The Guardian US↗Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
- Reuters↗Israeli firm used online ads to run vast spy operation, researchers say
- The Guardian↗Israeli firm’s digital ads enabling installation of ‘zero-click’ spyware, researchers say
- NBC News↗Israeli ad company helped a spyware firm target Al Jazeera through online ads, researchers say
