Researchers say an Israeli advertising company is being used to deliver spyware through online ads, in what they describe as the first documented case of a zero-click attack spread via targeted advertising. The firm, Discover-Tech, presents itself as an ordinary digital advertising agency. According to the investigation, it instead gives hacking groups a way to place malicious advertisements across the web.
Discover-Tech runs a platform called Controlium, which researchers say lets its spyware partners profile and de-anonymize millions of people, fingerprint their devices, and target them with zero-click hacking. The platform also allows partners to pick a specific user for infection or profiling by using that person's IP address, mobile ad ID, or browser identifier.
One group working with Discover-Tech is Candiru, an Israeli spyware vendor that has been blacklisted by the US government. In 2024 and 2025, ads from Discover-Tech delivered Candiru-linked spyware to Al Jazeera, the Qatar-based news network. Researchers say the companies targeted at least 45 devices at the outlet during that period.
The findings come from Citizen Lab and Confiant, which are calling on the advertising industry to strengthen security on its platforms. Google and Beeswax, an advertising company owned by Comcast, have removed Discover-Tech from their platforms, according to Reuters. IAB Europe has suspended the company from its list of approved vendors.
For US readers, the removals by Google and Comcast-owned Beeswax show how the case has already touched major American advertising infrastructure, even though the reported targeting centered on a foreign news network. Researchers also recommend that people at high risk of being targeted use ad blockers, turn off ad tracking, and reset their mobile ad IDs on a regular basis.
More cybersecurity news from TechManNews.
