Citizen Lab traces zero-click spyware delivery through online ads to Israeli ad-tech firm Discover-Tech

Citizen Lab has identified Israeli ad-tech firm Discover-Tech as the enabler of zero-click spyware delivery through ordinary online advertisements, with devices at Al Jazeera among those compromised in the campaign.

It is the first time researchers have found concrete technical evidence of zero-click spyware attacks delivered through online advertising. Working with the cybersecurity firm Confiant, the Citizen Lab team determined that Discover-Tech’s platform, Controlium, allows clients to profile and de-anonymize internet users and target them with zero-click spyware — infections that require no interaction from the victim to install. Bill Marczak, a researcher at Citizen Lab, said the finding confirms what had previously been suspicion. “There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” he said.

How the platform worked

Controlium can harvest a user’s identity and IP address when that user is shown a seemingly benign custom-created ad, such as one promoting a digital game or a telecoms service. Once a person is selected as a target, a spyware firm can send malicious code to their device within seconds and without their knowledge. The web dashboard appears specifically designed to push malicious content to individual targeted users alongside advertisements, according to the researchers. The spyware itself can access everything on a target’s device, extracting messages, photos and emails, recording calls and secretly activating microphones. Controlium acts as a facilitator for third-party spyware firms that have targeted government officials, journalists, businesspeople, activists, academics and embassy workers. Discover-Tech describes itself as a digital advertising agency.

Al Jazeera and the spyware makers

At least 45 devices at Al Jazeera were targeted in 2024 and 2025. Candiru, an Israeli spyware company that has been blacklisted by the US government, used Discover-Tech’s platform to deliver spyware to those devices. A second spyware maker, Bindecy, also used Discover-Tech’s platform to target people. Discover-Tech has been approached for comment.

Exposed data opened the door

Controlium left source code exposed on its login pages, allowing researchers to recreate its web-based control panel dashboard without logging in. Separately, Discover-Tech’s site had a publicly accessible portion allowing download of user login records for the Controlium dashboard without a password. Some of those login details belonged to at least two employees of Candiru, as well as some from Bindecy. Researchers also found billions of ad bidding records left exposed on Discover-Tech’s website, showing ads displayed across tens of thousands of mobile apps and websites between March and June 2026.

Reach and response

Potentially malicious ads were shown on devices on the networks of the International Atomic Energy Agency and the International Criminal Court. Discover-Tech’s ads were also shown to users of networks of government entities in Europe and the US, as well as the UN and Nato. It is unclear whether devices at these organizations were compromised or merely shown ads. Discover-Tech’s ads have been served to users in Yemen, Brazil, Mexico and Czechia. Following the findings, Google and Comcast-owned Beeswax removed Discover-Tech from their platforms, and IAB Europe suspended the company from its list of approved vendors. NBC News reported the story earlier.

What researchers recommend

Researchers recommend users at high risk use ad blockers, disable ad tracking, and reset mobile ad IDs.