Global Alarm: Israeli Firm Weaponized Targeted Ads for Zero-Click Spyware

A new report from the University of Toronto's Citizen Lab, published this week, has uncovered a shocking truth: an Israeli firm, Discover-Tech, disguised as a legitimate advertising company, has been actively weaponizing online targeted ads to deliver 'zero-click' mercenary spyware to devices worldwide. This groundbreaking investigation, co-timed with ad security firm Confiant, reveals how the ad industry's plumbing can be hijacked for silent, undetectable cyber espionage, profoundly escalating global security risks. The operation, dubbed 'AdFection' by Citizen Lab, enabled spyware vendors like Candiru to infect at least 45 devices belonging to Al Jazeera journalists between 2024 and 2025, simply by displaying ads, without requiring any clicks. Discover-Tech platform, 'Controlium', allegedly facilitated profiling and de-anonymizing millions of users, with their malicious ads appearing on over 120,000 websites and 70,000 mobile apps, even within national-security-sensitive networks globally, including NATO and the UN. This marks the first technical confirmation of mercenary spyware being distributed through targeted advertising, exposing a systemic vulnerability where legitimate ad networks are used for mass surveillance. The revelations have already triggered swift action, with Google and IAB Europe promptly removing Discover-Tech from their certified vendor lists and terminating its access to ad platforms in early October 2026. The Citizen Lab and other experts are now urgently calling on regulators and the wider ad-tech industry to investigate these companies and fundamentally rethink how they manage data and prevent such abuses, emphasizing that business as usual is no longer acceptable. This scandal is set to reshape debates around digital surveillance, privacy, and the unchecked power of commercial spyware.