An Israeli advertising agency has been serving millions of online ads that enable “no-click” spyware to be used against targets, researchers at a Canadian university said. Citizen Lab, a digital investigations research unit at the University of Toronto, said it believed dozens of devices at Qatari broadcaster Al Jazeera had been compromised by spyware distributed through targeted ads by Discover-Tech, which describes itself as an agency specializing in digital advertising. According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its clients to “massively profile and deanonymize” Internet users and then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, spyware does not require any interaction from the victim to install, making it a new delivery technique, says Citizen Lab. Infections occur without the user’s knowledge and within seconds, according to Citizen Lab.[The online advertising] “The ecosystem is being weaponized on a large scale to profile millions of users and then silently infect targets with mercenary spyware without clicking,” the report says. According to the report, Controlium is capable of collecting a user’s identity and IP address when they are shown a seemingly benign ad custom-created, for example, for a digital game or a telecommunications service. If the user has been selected as a target for hacking, a mercenary spyware company can send malicious code containing spyware to their device. say the researchers. They say millions of users around the world have received Discover-Tech ads since 2024, including Yemen, Brazil, Mexico and Czechia. Related work by research group Confiant also suggests that Discover-Tech ads have been shown to users on government entity networks in Europe and the US, as well as the UN, NATO, the international criminal court and the International Atomic Energy Agency. “The company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem works today is a threat to the security of states, the private sector, civil society and everyone else.” a target, extracting messages, photos and emails, recording calls and secretly activating microphones. The full extent of the targeting allegedly enabled by Discover-Tech is unknown. Citizen Lab’s findings add to growing evidence that the opaque agreements underpinning the world of online advertising can be exploited for surveillance. A researcher at Citizen Lab.Discover-Tech has been contacted for comment. When a user navigates to a website displaying ads, their details become part of a split-second programmatic auction involving dozens or hundreds of companies automatically bidding to place an ad in front of that user. These offers are based on the user’s profile, which may include information about your device and data collected about it by tracking your web activity. and cryptocurrencies could bid to show that individual an ad for an energy drink. There is little regulation in this automated online marketplace, and there is increasing evidence that it is being exploited by malevolent actors. Reuters has reported that billions of dollars in Meta advertising revenue comes from ads for scams, illegal gambling, pornography and other prohibited content. In the US, ICE and other government agencies have purchased software that uses ad tech data to track people’s movements. other regions must intervene urgently. They must investigate the companies involved and fix the systemic risks that enable malicious ad targeting,” Christl said.
