Researchers say Israeli ad firm delivered spyware through online ads

An Israeli advertising technology firm worked with spyware companies to deliver malicious ads that could infect devices, according to a joint investigation by security researchers at Citizen Lab and Confiant. Researchers say it is the first time they have found technical evidence of a zero-click attack delivered through targeted advertising. Zero-click attacks require no action from the user.

The firm, Discover-Tech, presents itself as an online advertising agency. The researchers say it operates Controlium, a platform that lets spyware partners profile people, identify their devices and target them. The platform can also select users for infection or profiling using an IP address, mobile advertising ID or browser identifier.

One partner is Candiru, an Israeli spyware company that the US government has blacklisted. In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to devices at Al Jazeera, the Qatar-based news network. Researchers say the companies targeted at least 45 devices there during those years.

Citizen Lab and Confiant called on the advertising industry to improve platform security. Google and advertising company Beeswax, owned by Comcast, have removed Discover-Tech from their platforms, while IAB Europe suspended it from its list of approved vendors, Reuters reports.