Researchers have found evidence of a zero-click attack delivered through targeted advertising for the first time. An Israeli ad tech firm, Discover-Tech, collaborated with spyware companies to infect devices, including those at Al Jazeera, simply by displaying online ads, according to a joint investigation by security researchers at Citizen Lab and Confiant. This type of hacking does not require any action from users.
Discover-Tech presents itself as a standard online advertising agency, but researchers claim it serves as a conduit for hacking groups to distribute malicious ads across the internet. The firm operates a platform named 'Controlium' that enables its spyware partners to profile and de-anonymize millions of individuals, fingerprint their devices, and target them with zero-click hacking. The platform allows users to be selected for infection or profiling based on their IP address, mobile ad ID, or browser identifier.
One of the groups associated with Discover-Tech is Candiru, an Israeli spyware company that has been blacklisted by the US government. In 2024 and 2025, Discover-Tech ads delivered spyware linked to Candiru to Al Jazeera, targeting at least 45 devices at the news outlet during that period.
Citizen Lab and Confiant have urged the advertising industry to enhance security measures on their platforms. In response, Google and the Comcast-owned advertising company Beeswax have removed Discover-Tech from their platforms, while IAB Europe has suspended the company from its list of approved vendors. Researchers also recommend that users at high risk of being targeted utilize ad blockers, disable ad tracking, and regularly reset their mobile ad IDs.