Researchers uncover how Israeli firm Discover-Tech used online ads to deliver zero-click spyware, targeting Al Jazeera and others. First evidence of ad-based zero-click attacks.
Introduction: A New Frontier in Cyber Espionage
In a groundbreaking joint investigation, security researchers from Citizen Lab and Confiant have exposed a sophisticated operation that leverages the online advertising ecosystem to deploy spyware. At the center is an Israeli ad tech firm called Discover-Tech, which allegedly collaborates with spyware companies to infect devices through malicious ads. This marks the first time researchers have found technical evidence of a zero-click attack—a hacking method requiring no user interaction—delivered via targeted advertising. The implications for digital privacy and security are profound, as this technique could democratize highly invasive surveillance.
Discover-Tech: The Ad Firm with a Hidden Agenda
On the surface, Discover-Tech presents itself as a typical online advertising agency. However, according to the investigation, it operates a platform named "Controlium" that serves as a pipeline for hacking groups. Controlium enables spyware partners to "precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking," the researchers report. The platform allows attackers to select targets for infection or profiling using identifiers such as IP addresses, mobile ad IDs, or browser fingerprints. This level of granular targeting turns everyday ad impressions into potential attack vectors.
The Zero-Click Attack: How It Works
Zero-click attacks are particularly insidious because they require no action from the victim—no clicking, no downloading, no opening of files. In this case, the attack is delivered through an online ad. When a user visits a website that displays ads from Discover-Tech's network, the malicious ad can exploit vulnerabilities in the browser or device to silently install spyware. The researchers explain that the ad itself acts as the infection vector, and the entire process is invisible to the user. This method bypasses traditional security awareness training and even some endpoint protections, making it a potent tool for espionage.
Candiru and the Targeting of Al Jazeera
One of the spyware groups working with Discover-Tech is Candiru, an Israeli company that has been blacklisted by the US government for its role in human rights abuses. In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, a Qatar-based news network. Researchers say the campaign targeted "at least" 45 devices at the news outlet during that period. This is not the first time Al Jazeera has been targeted by spyware, but the use of ad-based zero-click attacks represents a new escalation. The targeting of journalists underscores the threat to press freedom and the need for robust protections.
Industry Response and Recommendations
The investigation has prompted swift action from major players in the ad tech industry. Google and Comcast-owned advertising company Beeswax have removed Discover-Tech from their platforms, while IAB Europe suspended the company from its list of approved vendors, according to Reuters. Citizen Lab and Confiant are calling on the advertising industry to ramp up security measures to prevent similar abuses. They also recommend that high-risk individuals—such as journalists, activists, and politicians—use ad blockers, disable ad tracking, and regularly reset their mobile ad IDs. These steps can help mitigate the risk of being targeted by ad-based zero-click attacks.
Conclusion: A Wake-Up Call for Ad Tech Security
The discovery of ad-based zero-click attacks is a stark reminder that the online advertising ecosystem is not just a privacy concern but a national security issue. The ability to deliver spyware through ads without any user interaction erodes trust in digital advertising and highlights the urgent need for systemic reforms. As spyware vendors become more sophisticated, the ad tech industry must prioritize security and transparency to prevent its platforms from being weaponized. For now, users must remain vigilant and adopt defensive measures to protect themselves.