An Israeli advertising agency has placed ads seen by millions of Internet users that have left them exposed to spyware attacks, according to a new report from the University of Toronto’s Citizen Lab. The report, released Thursday, alleges that Discover-Tech intentionally operates a platform that allows its “partners to anonymize, fingerprint, and automatically infect devices” with spyware. Those partners can then “send malicious content to individual users along with ads,” it says. Over a four-month period, Discover-Tech ads appeared on more than 120,000 websites and more than 75,000 apps in dozens of countries, jeopardizing the security of “national security-sensitive networks” such as government ministries, armed forces and multilateral organizations such as NATO, according to the report, which was published alongside affiliated research from U.S. cybersecurity firm Confiant. Ron Deibert, director of Citizen Lab, said the findings are a “worst nightmare” scenario, bringing together “two poorly regulated and highly abused industries” (targeted advertising and mercenary spyware). “It’s a recipe for disaster,” Deibert told CBC News. “It is global espionage that we have discovered on a massive scale.” ‘Zero-click’ attacks Human rights groups have for years raised concerns about companies selling spyware to anyone, particularly oppressive governments, wishing to spy on the public, journalists, political figures and other perceived critics. Experts have also speculated that what is known as the targeted advertising ecosystem, where data brokers and advertising companies bid in real time to place ads on apps and websites, could be used for espionage. But Thursday’s report marks the first time researchers have documented how targeted ads can enable “zero-click” spyware attacks, Citizen Lab says. “Zero-click” means that users don’t need to click on a link or do anything active for their devices to be attacked by spyware. “The moment [the ad] is processed, your device can be hacked, so there is really no defense against this except not using a smartphone or [not] connect to the Internet,” Deibert said. These types of infections can be difficult to detect. The report says that some Discover-Tech ads also appeared on the websites of news media, including CBC, BBC and the New York Times. But Deibert says there is not much those organizations could have done to prevent it. WATCH | Spyware and the OPP: OPP may have secretly used controversial technology that can spy on citizens. Controversial spy software that offers easy and complete access to the phone of a stranger is now reportedly in use by the Ontario Provincial Police Metro Morning spoke to researchers at Citizen Lab to learn more about the controversial technology and their investigation into the OPP. “It’s simply the advertising ecosystem working as intended,” he said. Discover-Tech did not respond to CBC News’ requests for comment via a contact form on the company’s website. Chuck Thompson, CBC’s head of public affairs, said in an email that the public broadcaster’s records “have no trace of having delivered any.” Discover-Tech ad” escalated to Google. operates systems for ad sellers, “to verify and provide responses,” it said. Al Jazeera noted. Citizen Lab said it was able to confirm a spyware attack targeting Al Jazeera: At least 45 of the Qatar-based news outlet’s devices were infected with spyware through Discover-Tech ads in 2024 and 2025, according to the report. When spyware is implanted, the operator behind the hack can take control of the device “It can turn on the camera, turning on the device’s microphone and tracking someone’s geolocation, so it’s kind of like god-like capabilities,” Deibert said. Researchers linked the no-click attacks on Al Jazeera “with high confidence” to spyware from Candiru, an Israel-based company that the report said has rebranded itself as Integrity Labs. LISTEN | How Spyware Abusers Can Easily Hack Your Phone: Ideas 53:59 Spyware Abusers Can Easily Hack Your Phone and Keep an Eye on It. 2021, the US Department of Commerce sanctioned Candiru “based on evidence that [it] developed and supplied spyware to foreign governments who used these tools to maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers.” CBC News could not immediately find a way to contact Candiru on Thursday. The Reuters news agency also said its attempts were unsuccessful. An Al Jazeera spokesperson condemned the attack on its staff by spyware as a “deliberate attack on journalists and press freedom.” (Malak Harb/The Associated Press) A spokesperson of Al Jazeera Media Network told CBC News in an email that it “strongly condemns the targeting of our staff with mercenary spyware.” “This is a deliberate attack on journalists and press freedom,” the spokesperson said, adding that while Al Jazeera does not speculate on who used the spyware, it is calling for “a full and independent investigation to identify those responsible and hold them accountable.” “very worrying” questions, including around personal privacy. “Most people don’t realize this could happen to them, so it’s a very big problem,” he said. Citizen Lab researchers said their findings should prompt advertising providers to “significantly increase their cybersecurity and threat detection capabilities to effectively isolate malicious advertisers.” applicable privacy and security.” investigate the report’s allegations or take any immediate action. A Google spokesperson told CBC News in an emailed statement that it blocked Discover-Tech from its advertising platforms “for systematically violating” the company’s policies, and that it has put warnings in place “to help protect people if they navigate to websites linked to this group,” they said. IAB Europe, a European association that develops frameworks for the digital marketing and advertising ecosystem, also said Thursday that Discover-Tech was suspended from its list. from global suppliers for violating their terms.
