Researchers found that DiscoverTech secretly used online ad networks to deliver zero-click spyware to at least 45 devices.
An Israeli digital advertising company secretly helped spyware developers plant malicious hacking code across everyday websites, infecting at least 45 devices at the news network Al Jazeera, NBC News reported.
The operation, uncovered in a joint investigation published Thursday by the University of Toronto’s Citizen Lab and the ad security firm Confiant, marks the first time researchers have documented technical evidence of zero-click attacks delivered directly through ordinary web advertising. Zero-click exploits infect a computer or phone without requiring the victim to download an attachment or click a link. Simply visiting a webpage displaying the ad was enough to compromise vulnerable systems during attacks in 2024 and 2025, The Verge reported.
Spyware developers typically license their surveillance software to foreign governments under the claim of national security, but researchers have documented repeated cases where state clients used the tools against journalists, political opposition figures and human rights defenders.
How the secret Controlium system operated
The Tel Aviv-based firm, DiscoverTech, markets itself publicly as a typical online ad broker. On its website, the company states, “We take pride in providing our clients with a gateway to global fraud-free traffic, connecting your brand with real users.”
Behind that public facade, researchers found the company ran an unlisted internal program called Controlium. Citizen Lab and Confiant discovered source code for the tool on DiscoverTech login pages, revealing how it plugged into the automated ad-bidding networks that power modern websites.
Online ad systems regularly gather technical data to help commercial brands direct promotions to specific audiences. Controlium repurposed those mechanisms for surveillance. The system let spyware operators identify and target specific individuals using their mobile advertising IDs, internet browser identifiers and IP addresses, which can reveal home locations. Once operators selected a target, DiscoverTech’s ad pipelines delivered the exploit directly to the browser window.
Links to blacklisted spyware and past Al Jazeera attacks
The researchers determined that the Israeli spyware firm Candiru used DiscoverTech’s infrastructure to transmit malicious code to Al Jazeera computers. Candiru now operates under the name Integrity Labs. The U.S. Commerce Department placed Candiru on its Entity List in 2021 after finding foreign governments used its products to monitor activists, reporters and officials.
Al Jazeera shared internal network logs with Citizen Lab to help investigators reconstruct how the intrusions happened. The news organization previously faced targeted digital surveillance. Citizen Lab previously found that 36 Al Jazeera journalists and staff members had their mobile phones hacked with Pegasus spyware, a tool created by Israeli firm NSO Group and believed to have been operated by clients tied to Saudi Arabia and the United Arab Emirates.
Al Jazeera, DiscoverTech and DiscoverTech’s chief executive did not respond to requests for comment.
Industry blacklists and user defenses
DiscoverTech’s commercial reach extends to nearly 200,000 websites and mobile applications on Android and iOS. Its ads run across search engines, media outlets, dating apps and government domains. Confiant found the company’s ads appearing on networks belonging to the Dutch Economic Affairs Ministry and the U.S. Defense Department, though researchers noted that ad placements do not mean those institutions were targeted for hacking.
Following the report, major digital advertising platforms severed connections with the company. Google affirmed the findings and confirmed it banned DiscoverTech from Google Ads. The European advertising trade group IAB Europe suspended the firm, and ad platforms Beeswax, Vungle and Eskimi also cut off access.
Citizen Lab researcher Wolfie Christl noted that the case proves how vulnerable standard browsing remains. He said, “I think that our findings confirm once again that ad blocking must be considered a cybersecurity best practice.” Researchers also urged high-risk individuals to reset their mobile device advertising IDs and turn off app ad-tracking permissions.
