It was revealed that Israel-based advertising technology company Discover-Tech was involved in a system that allows devices to be infected with spyware without users clicking any links.
According to research by Canada-based Citizen Lab, users' identity and device information can be detected through ordinary advertisements. Spyware can then be installed on the devices. Researchers determined that at least 45 devices used by Qatar-based Al Jazeera employees were targeted with this method.
IT IS ENOUGH TO SEE THE ADVERTISEMENT
Citizen Lab, the digital research unit at the University of Toronto, published the results of its research on Discover-Tech's activities. According to the report, the company helped companies developing spyware reach users around the world through advertising technologies.
Discover-Tech's platform called Controlium enables targeting using users' internet activities and device information. Researchers stated that the system was able to detect the identity and IP address of users, which then allowed the devices of certain people to be infected with spyware.
The most striking feature of the method is that it does not require the user to click on the ad or download a file. In the so-called "zero-click" method, the target device's viewing of a specially prepared ad can initiate the attack process. According to researchers, this process can occur within seconds without the user knowing.
The Citizen Lab report included the following statements:
“The online advertising ecosystem is being weaponized to profile millions of users and then silently infect targets with zero-click paid spyware.”
AL JAZEERA EMPLOYEES' DEVICES WERE TARGETED
One of the important findings of the research was the attacks on the devices of Qatar-based Al Jazeera Media Network employees. Al Jazeera's technology team detected unusual activity on some journalists' devices in 2024. When similar symptoms were observed in 2025, the institution asked Citizen Lab to conduct a technical investigation.
As a result of the investigation, Citizen Lab concluded that at least 45 devices were infected with software developed by Israeli spyware company Candiru through targeted advertisements. According to the report, this incident is considered the first known example of the zero-click method being used through targeted advertising.
Citizen Lab stated that network logs provided by Al Jazeera reveal how the attack occurred. The research team made the following statements in its report:
"Analysis of network logs provided to Citizen Lab by Al Jazeera during the attack period reveals a clear temporal signature of how the attack was carried out."
Al Jazeera Media Network condemned spyware attacks targeting its employees. The institution described the targeting of journalists as "an attack on press freedom" and demanded that those responsible be held accountable. Al Jazeera also announced that it will continue its efforts to protect its employees and systems.
WHAT INFORMATION CAN CANDIRU'S SPYWARE ACCESS?
The US administration blacklisted the Israeli company Candiru in 2021 due to its malicious cyber activities. The company's spyware has previously been reported to be used to spy on journalists, dissidents and others.
According to Citizen Lab's findings, Discover-Tech operated as part of a system that led devices to Candiru's spyware through targeted ads. The report stated that these software can access sensitive information on devices.
The data that the spyware can access includes documents, files, browser history, cookies, bookmarks and saved credentials. It was stated that the software can also record keystrokes, take screenshots, activate the microphone and camera, and access e-mail and messages.
It was also reported that encrypted communication channels were used to make it difficult to detect attacks and stolen data could be sent in small pieces. The cost of the spyware system is estimated at several million dollars.
Citizen Lab researcher Bill Marczak made the following assessment on the subject:
“There have been many rumors that online ads could be used to precisely identify and automatically hack targets, but now for the first time we have concrete technical evidence showing this process in action.”
MILLIONS OF DEVICES MAY BE AT RISK
According to Citizen Lab's report, Discover-Tech has engaged in activities that enable the targeting of specific users using advertising technologies for approximately six years. It was stated that the advertisements prepared by the company were shown on approximately 200 thousand websites and mobile applications in a four-month period.
It was reported that, starting from 2024, advertisements prepared by Discover-Tech were shown to millions of users in many countries, including Yemen, Brazil, Mexico and the Czech Republic. Researchers stated that these ads can be used to identify users and select certain devices for spyware attacks.
According to Citizen Lab, Controlium acts as a middleman for spyware companies that target government officials, journalists, business people, activists, academics and embassy employees. However, the full scope of the attacks allegedly carried out via Discover-Tech is not yet known.
IT WAS ALSO SEEN IN THE NETWORKS OF GOVERNMENT INSTITUTIONS
A separate investigation by ad security company Confiant found that some ads published by Discover-Tech were also shown to people using sensitive institutions' networks.
The ads also appeared on networks used by government agencies in the United States and Europe, as well as the United Nations, NATO, the International Criminal Court and the International Atomic Energy Agency. These findings alone do not prove that the networks of these institutions were affected by the attacks. However, it shows the width of the area that ads can reach.
Citizen Lab researcher Wolfie Christl said:
“It is disastrous that major advertising providers and organizations have been unable to detect or block the company's malicious advertising activities for years.”
Christl stated that the operation of the online advertising system poses a security threat to everyone, including governments, the private sector and civil society.
According to the research, Discover-Tech's advertisements also reached users through platforms such as Google and Yandex. Various platforms, including Google, have taken steps to block the company from accessing their advertising ecosystems.
HOW IS THE ADVERTISING SYSTEM USED FOR SPYING?
A significant portion of the advertisements shown to Internet users are determined by automatic systems called programmatic advertising. When a user enters the website, information about the device and user profile can be evaluated in ad auctions that take place within seconds.
Advertisers offer automatic bids to reach users with certain characteristics through this system. However, according to researchers, the same infrastructure can also be misused to identify users and target them for spyware attacks.
Citizen Lab researcher Wolfie Christl called on authorities to take action.
