A joint investigation by Citizen Lab and Confiant reveals that Israeli advertising technology company Discover-Tech collaborated with spyware groups to deploy zero-click malware through online ads, affecting high-profile targets such as Al Jazeera.
- Discover-Tech used online ads to deploy malware without user clicks
- At least 45 devices at Al Jazeera targeted with spyware in 2024-2025
- Google, Beeswax removed Discover-Tech; IAB Europe suspended vendor status
What happened
Researchers from Citizen Lab and Confiant exposed that Discover-Tech, an Israeli ad tech company, partnered with spyware operators to infect devices through online ads. This method leveraged zero-click attacks, which do not require any interaction by the user to compromise their device. The ads were delivered in targeted campaigns, including ones that reached Al Jazeera, a Qatar-based media organization.
The investigation uncovered that Discover-Tech’s platform Controlium allowed its spyware clients to profile and de-anonymize users precisely by analyzing device fingerprints and identifiers such as IP addresses and mobile ad IDs. Using these data points, they could selectively infect specific users, enabling a stealthy compromise that escaped typical detection.
Why it matters
This finding marks a significant escalation in online threats by demonstrating that sophisticated spyware can be deployed through mainstream digital advertising frameworks. Zero-click attacks circumvent traditional security defenses because users do not have to engage with malicious content, making detection and prevention far more challenging.
The use of digital advertising for delivering spyware raises serious concerns about the trustworthiness and security of online ad networks. It also implicates large ad platforms in inadvertently distributing malicious content, prompting calls for more robust security measures to protect users and organizations from targeted cyber intrusions.
What to watch next
Following the exposure, major advertising platforms like Google and Beeswax have removed Discover-Tech from their services, while IAB Europe has suspended the company from its approved vendor list. Industry groups will likely intensify efforts to vet ad network operators and enforce stricter security standards to prevent similar campaigns.
Users considered high-risk for targeting, including journalists and activists, are advised to adopt stronger digital hygiene practices such as using ad blockers, disabling ad tracking, and frequently resetting mobile ad identifiers. The broader conversation about privacy and ad tech accountability is expected to gain renewed urgency in light of these findings.