An Israeli digital advertising agency is allegedly facilitating the distribution of “zero-click” spyware through its online ads, according to recent findings by researchers from Citizen Lab, a digital investigations unit affiliated with the University of Toronto. This alarming revelation highlights a new and covert method of spyware delivery that requires no user interaction.
Citizen Lab’s investigation suggests that dozens of devices belonging to employees at the Qatari broadcaster Al Jazeera have been compromised through targeted advertisements managed by Discover-Tech, a company claiming to offer specialized digital advertising solutions.
The research indicates that Discover-Tech operates a software platform named Controlium, which purportedly enables clients to construct detailed profiles of internet users. With this tool, they can hack select targets silently using third-party spyware. Unlike traditional methods that require users to click links or download files, the new approach enables spyware installation without any user action, making it particularly insidious.
According to the findings, the installation of the spyware occurs within seconds, often without the victim’s knowledge. The report states, “The online advertising ecosystem is being weaponised at a massive scale to profile millions of users and then silently infect selected targets with zero-click mercenary spyware.”
Research shows that through harmless-looking ads—such as those promoting video games or telecom services—Controlium can capture a user’s identity and IP address. If a user is identified as a target, a mercenary spyware firm can deliver malicious code directly to their device.
Since 2024, it’s estimated that millions of users globally, including in countries like Yemen, Brazil, Mexico, and Czechia, have been served ads by Discover-Tech. Concerningly, related research from Confiant also indicates that these ads have targeted users connected to governmental bodies in both Europe and the United States, alongside organizations such as the UN, NATO, the International Criminal Court, and the International Atomic Energy Agency.
Wolfie Christl, a researcher with Citizen Lab, remarked on the failure of advertising platforms and organizations to detect or halt the malicious activities of Discover-Tech: “It’s disastrous… the online advertising ecosystem today poses a security threat to states, the private sector, civil society, and many others.”
Citizen Lab describes Controlium as a facilitator for spyware firms targeting a diverse range of individuals, including government officials, journalists, business executives, activists, scholars, and embassy staff. This spyware reportedly has the capability to access comprehensive information from targets’ devices—extracting messages, images, and emails while also having the ability to record calls and activate microphones silently.
The full scale of Discover-Tech’s targeting remains unclear. Citizen Lab’s conclusions add to mounting evidence that the opaque nature of online advertising can be exploited for surveillance purposes.
Bill Marczak, another researcher at Citizen Lab, stated, “While there has been much speculation regarding online ads being utilized for precise identification and hacking, we now have direct technical evidence demonstrating this process in action for the first time.”
Discover-Tech has yet to respond to the allegations.
When users visit a website displaying advertisements, their information is rapidly integrated into an automated auction system involving numerous companies, which bid to display ads based on the user’s profile. This profile is often generated from collected data regarding the user’s online activity. A profile indicating interest in sports betting, for example, could receive ads for energy drinks.
The lack of regulation in this automated online market raises concerns, especially as evidence mounts that it is being exploited by malicious entities.
Recent reports have highlighted that a significant portion of Meta‘s advertising revenue may come from promoting scams, gambling, and other prohibited content. Furthermore, U.S. agencies like ICE have purchased software that utilizes ad tech data for tracking individuals’ movements.
Christl urges immediate intervention by cybersecurity agencies, regulators, and lawmakers across the globe to investigate the involved companies and address the systemic vulnerabilities enabling such malicious ad targeting.
Editor’s Take
This revelation underscores a significant vulnerability in the online advertising industry, highlighting the urgent need for regulatory action. Users face potential risks of surveillance and data exploitation while businesses may need to reassess their ad partnerships. As technology evolves, so too must the frameworks protecting individuals and entities alike within the digital ecosystem.
Source: www.theguardian.com
