An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It is the first time researchers have found technical evidence of a zero-click attack, a form of hacking that requires no action by users, delivered through targeted advertising, as reported earlier by NBC News.
The ad firm, called Discover-Tech, presents itself as a typical online advertising agency, but researchers say it provides a pipeline for hacking groups to plant malicious ads across the web. Its platform, known as "Controlium," allows spyware partners to "precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking." It also lets them select a user for infection or profiling using an IP address, mobile ad ID, or browser identifier.
One partner is Candiru, an Israeli spyware company blacklisted by the US government. In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, a Qatar-based news network. Researchers say the companies targeted "at least" 45 devices at the outlet in that period.
Citizen Lab and Confiant call on the advertising industry to strengthen security on its platforms. Google and the Comcast-owned advertising company Beeswax have since removed Discover-Tech, while IAB Europe suspended the company from its list of approved vendors, Reuters reports. Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset their mobile ad IDs.
Source: Hacker News · Summarized by HeadlinesBriefing