Online adverts used to deliver zero-click spyware, researchers say

An Israeli advertising agency has been serving millions of online adverts that allow “zero-click” spyware to be installed on targets’ devices, according to researchers at the University of Toronto. Citizen Lab, the university’s digital investigations unit, says the technique needs no action from the victim at all, and that it has been running at scale since 2024.

What happened

Citizen Lab has published findings about Discover-Tech, a company that describes itself as a specialised digital advertising agency. According to the researchers, Discover-Tech operates a software platform called Controlium that lets its clients “mass-profile and deanonymise” internet users, then covertly hack chosen targets using spyware supplied by third parties.

As Citizen Lab describes it, the process begins with an ordinary-looking advert, perhaps for a digital game or a telecoms service. When the advert appears on someone’s screen, Controlium can harvest that person’s identity and IP address. If the person has been selected as a target, a mercenary spyware firm can then send malicious code containing spyware to their device. The researchers say this happens in a matter of seconds and without the user’s knowledge.

Citizen Lab says the delivery method is new. Most spyware infections rely on someone clicking a link or opening a file. This one requires no interaction. “[The online advertising] ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware,” the report says.

The Guardian reports that Citizen Lab believes dozens of devices at the Qatari broadcaster Al Jazeera were compromised by spyware delivered through Discover-Tech’s adverts. The researchers say millions of users worldwide have been served the company’s ads since 2024, including people in Yemen, Brazil, Mexico and Czechia. Separate work by the research group Confiant suggests the ads also reached users on the networks of government bodies in Europe and the US, as well as the UN, Nato, the International Criminal Court and the International Atomic Energy Agency.

Citizen Lab says Controlium acts as a “facilitator” for spyware firms that have targeted “government officials, journalists, businesspeople, activists, academics and embassy workers”. The spyware involved can reportedly access everything on a target’s device: it can extract messages, photos and emails, record calls and secretly switch on the microphone. The full extent of the targeting is not known.

“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a researcher at Citizen Lab. The Guardian says Discover-Tech has been approached for comment.

Why it matters if you live in United Kingdom

The story concerns the advertising system behind almost every website you visit, in Britain or anywhere else. The Guardian explains that when you open a page carrying adverts, your details enter a split-second automated auction involving dozens or hundreds of companies. They bid to show you an advert based on your profile, which can include information about your device and data gathered by tracking your activity across the web. The Guardian describes this market as lightly regulated, with growing evidence that bad actors are exploiting it.

That matters for ordinary internet users because the usual advice on staying safe online centres on not clicking suspicious links or opening unknown attachments. According to Citizen Lab, this technique gets round that advice completely, because an infection can follow simply from an advert being displayed.

The researchers say the spyware has been aimed at particular groups rather than the general public. If you work as a journalist, an academic, an activist, in business, for an embassy or for a government, you belong to one of the categories Citizen Lab lists. Many internationals in the UK work in exactly these fields, and some keep close ties with countries named in the research. The source does not say whether anyone in Britain has been targeted. Even so, the report’s warning that ads reached government networks in Europe and organisations such as Nato shows how widely the system has spread.

Citizen Lab researcher Wolfie Christl was blunt about the wider failure. “It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” he said. “The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.”

What to watch next

Christl has called for regulators to act. “Cybersecurity agencies, regulators and lawmakers in the US, Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting,” he said. Whether European authorities respond, and whether major advertising platforms explain how these adverts passed their checks for years, will show how seriously the findings are being taken.

Discover-Tech’s response is also still to come. The Guardian has asked the company for comment, and its reply may dispute or add context to Citizen Lab’s account.

The findings add to a growing body of concern about ad technology. The Guardian notes that Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from adverts for scams, illegal gambling, pornography and other banned content, and that in the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements. Pressure for tighter rules on how personal data moves through ad auctions looks likely to grow. For more coverage of cybersecurity and online privacy, visit Mylistingo.

Source: The Guardian