Researchers at the University of Toronto’s Citizen Lab have identified an Israeli advertising agency they say has been distributing online advertisements that serve “zero-click” spyware, capable of compromising targeted devices without any interaction from users. The agency, Discover-Tech, operates a platform named Controlium, which reportedly enables clients to profile internet users extensively and deliver spyware covertly through digital ads.
Citizen Lab’s investigation suggests that the spyware has affected dozens of devices at Al Jazeera, the Qatari broadcaster. The spyware infections occur without user awareness and are initiated when a targeted individual is shown a seemingly ordinary advertisement, such as those promoting digital games or telecom services. This ad acts as a vector for malicious code, allowing third-party mercenary spyware firms to gain unauthorized access remotely.
The researchers describe Controlium as a system that can harvest information including user identities and IP addresses in real time during ad delivery. According to Citizen Lab, since 2024 millions of users worldwide have been shown ads linked to Discover-Tech, spanning countries such as Yemen, Brazil, Mexico, and Czechia. Additional investigative work from Conflict has indicated that Discover-Tech’s ads may have been displayed on networks associated with government agencies in Europe and the United States, as well as international organizations including the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency.
“This exploitation of the online advertising ecosystem at such a vast level represents a significant security risk to governments, businesses, civil society, and individuals,” said Wolfie Christl, a Citizen Lab researcher. The platform’s capabilities reportedly put a diverse range of targets at risk—government officials, journalists, activists, businesspeople, academics, and embassy personnel, among others.
The spyware enabled by Controlium can allegedly access a target device’s messages, emails, photos, and calls, and can surreptitiously activate microphones. Citizen Lab noted that Discover-Tech acts as a facilitator, enabling other spyware firms to carry out attacks, though the full scope of compromised targets remains unclear.
Bill Marczak, another researcher from Citizen Lab, stated that the findings provide the first concrete technical evidence of automated online ads being weaponized to identify and hack specific individuals with precision, confirming concerns raised previously about such tactics.
Discover-Tech was contacted for comment but had not responded as of the report’s publication.
The online advertising ecosystem functions through programmatic auctions where companies bid in real time to display ads based on detailed user profiles compiled from tracking online behavior. While this system largely remains unregulated, the new findings illustrate how it can be exploited for surveillance and cyberattacks.
Cybersecurity experts and researchers emphasize the urgent need for regulators and lawmakers in the United States, Europe, and other regions to investigate these practices and address the systemic vulnerabilities in online ad networks that facilitate such malicious targeting.
“This issue is not just a technical problem but a policy and security challenge that requires coordinated action,” Christl added.