An Israeli digital advertising company has allegedly enabled spyware operators to identify and infect targeted devices through ordinary online advertisements, without requiring users to click on links or download files, an investigation by researchers at the University of Toronto has found.
Citizen Lab, the university’s digital investigations research group, said that it believed dozens of devices at Qatari broadcaster Al Jazeera had been compromised through spyware delivered via advertisements run by Discover-Tech, a company that describes itself as a specialised digital advertising agency.
The investigation identified a platform called Controlium, which Discover-Tech operates. Researchers said that the software allows clients to profile internet users and identify individuals for covert surveillance using spyware developed by third parties.
Unlike conventional cyberattacks that depend on a victim opening a malicious link or attachment, the alleged technique can infect a device without any action from its owner. Citizen Lab said that the process could take place within seconds and without the user’s knowledge.
“The online advertising ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware,” the report said.
According to the researchers, Controlium can collect identifying information, including a user’s IP address, when they are shown a seemingly harmless advertisement, such as one promoting a game or telecommunications service.
If the person matches a client’s intended target, a spyware operator can then use the system to deliver malicious code to their device, the report said.
Discover-Tech has reportedly served advertisements to millions of users worldwide since 2024, including people in Yemen, Brazil, Mexico and Czechia.
Separate research by the group Confiant also indicated that the company’s advertisements had appeared on networks used by government bodies in Europe and the United States (US), as well as international organisations including the United Nations (UN), North Atlantic Treaty Organisation (NATO), the International Criminal Court (ICC) and the International Atomic Energy Agency (IAEA).
Wolfie Christl, a Citizen Lab researcher, criticised the apparent failure to identify and stop the operation.
“It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” he said.
He warned that the structure of the online advertising industry had created security risks for governments, businesses, civil society and individuals.
Citizen Lab described Controlium as a “facilitator” for third-party spyware companies whose targets have included government officials, journalists, businesspeople, activists, academics and embassy staff.
The researchers said that the spyware could potentially extract messages, photographs and emails, record calls and secretly activate microphones. However, the full extent of the alleged targeting remains unknown.
Bill Marczak, another Citizen Lab researcher, said that the investigation provided technical evidence of how online advertisements could be used to identify and automatically hack selected targets.
Discover-Tech was approached for comment.
The findings add to concerns that the online advertising industry, which relies on the rapid exchange of user data between numerous companies, can be exploited for surveillance.
When someone visits a website carrying advertisements, an automated auction can take place in milliseconds, with multiple companies bidding to display an advert based on information associated with that user. The process can draw on device details and profiles built through online tracking.
