Check your devices for spyware delivered via online advertising networks
Security researchers say an Israeli ad firm helped deliver zero-click spyware to journalists, including staff at Al Jazeera, without any user interaction.
Key points
- Discover-Tech used its Controlium platform to target specific individuals with malicious ads.
- At least 45 Al Jazeera devices were infected in 2024 and 2025 via these ads.
- Google, Beeswax and IAB Europe have removed or suspended the firm from their services.
Journalists and other high-profile targets may have had their devices compromised through standard online advertising. Security researchers from Citizen Lab and Confiant found technical evidence that an Israeli ad tech firm, Discover-Tech, facilitated zero-click spyware attacks. This method requires no action from the victim, such as clicking a link or opening an attachment. The infection occurs simply by viewing the malicious advertisement on a screen.
Who is targeted by these advertising attacks?
The investigation identified Al Jazeera, a Qatar-based news network, as a primary victim. Researchers stated that at least 45 devices at the news outlet were infected during 2024 and 2025. The spyware was delivered through ads served by Discover-Tech. The firm works with spyware groups, including Candiru, which has been blacklisted by the US government. These groups use the advertising platform to profile and de-anonymise millions of individuals, fingerprinting their devices to select specific users for infection or surveillance.
How does the spyware reach users?
Discover-Tech operates a platform called Controlium, which presents itself as a standard online advertising agency. According to the joint investigation, it actually provides a pipeline for hacking groups to plant malicious ads across the web. The platform allows partners to precisely profile users and target them with zero-click hacking. Attackers can select a user for infection using their IP address, mobile ad ID or browser identifier. This technical capability enables the delivery of spyware without the user needing to interact with the ad content in any way.
What has the industry done so far?
Major advertising platforms have taken action against Discover-Tech following the revelations. Google and Beeswax, a Comcast-owned advertising company, have removed the firm from their platforms. Reuters reports that IAB Europe has suspended the company from its list of approved vendors. Citizen Lab and Confiant called on the wider advertising industry to ramp up security measures on their platforms. These steps aim to prevent similar exploitation of advertising networks for delivering malicious software to unsuspecting users.
What comes next for affected organisations?
Researchers recommend that users at high risk of targeting take specific protective measures. They advise using ad blockers to prevent malicious ads from loading on devices. Disabling ad tracking features can also reduce the surface area for fingerprinting attacks. Regularly resetting mobile ad IDs is another suggested step to disrupt the profiling capabilities used by the spyware partners. These actions help mitigate the risk of being targeted through the advertising infrastructure that facilitated these zero-click attacks.
What affected people can do
Teams usually review advertising logs to identify unusual traffic patterns from known malicious sources. Check whether your device has recently installed unknown applications or exhibited unusual battery drain, which can signal background spyware activity. Look for follow-up phishing attempts that reference this breach to trick you into revealing credentials. Reset your mobile advertising identifiers if your device allows it, and consider using browser extensions that block third-party tracking scripts. Monitor your accounts for unauthorised access attempts, as attackers often leverage compromised devices to harvest sensitive data or credentials for further exploitation.
Background: Browser extension vulnerabilities
Browser extensions run with elevated permissions that bypass standard website security boundaries. Small businesses face heightened risk because staff install tools without central oversight. Protect your network by enforcing strict extension allow-lists, disabling unused add-ons, and verifying vendor trustworthiness before deployment.
Read the full guide: Browser Extension Vulnerabilities: Risks and Protection for Small Businesses
What to do and how to stay safe: Discover-Tech
- Use reputable ad-blocking software to prevent potentially malicious advertisements from loading on your device.
- Disable personalised ad tracking in your device settings to limit the data available for user profiling.
- Regularly reset your mobile advertising ID to disrupt persistent tracking mechanisms used by spyware.
- Monitor your device performance and battery usage for signs of hidden background processes or applications.
Step-by-step guide: Stop Spyware: Practical Prevention Measures That Actually Work
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did users have to click on the ads to get infected?
No, researchers confirmed this was a zero-click attack, meaning the spyware was delivered simply by viewing the online ad.
Which spyware company was involved with Discover-Tech?
The investigation linked Discover-Tech to Candiru, an Israeli spyware company that has been blacklisted by the US government.
Have any platforms removed Discover-Tech?
Yes, Google and Beeswax have removed the firm, while IAB Europe suspended it from its approved vendor list.
