Researchers say ad technology has become a spyware delivery channel
Online advertising systems can be used not only to reach audiences but also to profile and covertly target individual devices with spyware, according to researchers at Citizen Lab, the digital investigations unit at the University of Toronto. Their findings, reported by the Guardian, centre on Discover-Tech, an Israeli company that describes itself as a specialised digital advertising agency.
Citizen Lab says Discover-Tech operates a software platform called Controlium. The researchers allege that the platform enables clients to mass-profile and deanonymise internet users, then facilitate the delivery of third-party mercenary spyware to selected targets. The alleged technique is notable because it does not depend on a target clicking a malicious link, opening an attachment or otherwise interacting with an attacker.
In this account, a person can be shown what appears to be an ordinary custom-made advertisement, such as an ad for a mobile service or a digital game. The advertising process can expose identifying information including an internet protocol address. If that person has already been selected for surveillance, the researchers say malicious code carrying spyware can then be sent to the device.
Why “zero-click” matters
Many security warnings concentrate on persuading people not to click suspicious links or download unfamiliar files. A zero-click infection changes that equation: the alleged compromise happens without an action by the person using the device and without their knowledge. Citizen Lab says the process can take only seconds.
That makes the advertising ecosystem especially consequential. Digital ads are routinely delivered at vast scale and often involve multiple intermediaries, data exchanges and automated bidding systems. In Citizen Lab’s description, that infrastructure can first be used to identify potential targets among a much larger population and then, for a small number of selected people, to route a malicious payload.
The researchers described the model as a way to weaponise advertising at scale: broad profiling of millions of users can coexist with highly selective infections. The concern is therefore not simply that a deceptive advertisement might carry malware, but that the systems used to tailor and distribute ads could also assist in finding specific devices for surveillance.
Al Jazeera devices were among the alleged targets
Citizen Lab said it believed dozens of devices at the Qatari broadcaster Al Jazeera had been compromised through spyware delivered via Discover-Tech advertising. The reporting does not establish that every person who was served an ad was targeted for infection. Rather, the researchers’ allegation is that ad delivery supplied an initial opportunity to collect identifying information, after which selected targets could be attacked.
The reported activity extends beyond a single country or organisation. Citizen Lab says millions of users worldwide have been served Discover-Tech advertisements since 2024, including users in Yemen, Brazil, Mexico and Czechia. Separate work by the research group Confiant, cited in the report, indicated that Discover-Tech ads were also shown to users on networks associated with government bodies in Europe and the United States, as well as the United Nations, Nato, the International Criminal Court and the International Atomic Energy Agency.
Those observations do not mean that every user on those networks was infected. They do, however, illustrate the breadth of the ad-distribution environment through which alleged targeting activity could occur.
A problem larger than a single campaign
The case highlights a difficult security problem for advertising platforms, publishers and organisations that depend on internet-connected devices. Advertising is designed to be embedded across websites and apps, frequently arriving through complex supply chains rather than directly from a site operator. That scale makes it useful for legitimate commercial communication, but it can also make misuse difficult to spot quickly.
Citizen Lab researcher Wolfie Christl said it was alarming that major advertising vendors and organisations apparently had not detected or stopped the alleged malicious advertising operations for years. The key implication is that device security cannot rely solely on users making cautious choices. If a compromise is genuinely zero-click, the usual advice to avoid suspicious interaction offers limited protection.
For the wider technology sector, the findings add pressure to improve scrutiny of advertising intermediaries, the data they collect and the code that ads can deliver. The allegations also underscore why spyware investigations increasingly focus on the technical and commercial infrastructure around an exploit, rather than only on the company that created the surveillance software.
What remains important to establish
The reported findings are allegations from researchers and should be assessed alongside technical evidence and responses from the companies involved. Still, the account offers a clear warning about the convergence of ad-tech profiling and commercial spyware: systems built to recognise and reach online audiences may also create opportunities to identify and silently target individuals.
As more sensitive work takes place on ordinary consumer devices and through browser-based services, the line between a routine advert and a security-relevant software delivery event becomes more important. The research suggests that protecting people against spyware will require attention not only to suspicious messages and files, but also to the infrastructure that decides which ads appear on which screens.
This article is based on reporting by The Guardian. Read the original article.
Originally published on theguardian.com
