Zero‑click spyware spreads via online ads, researchers warn

Citizen Lab and cybersecurity firm Confiant have shown that an Israeli advertising company, Discover‑Tech, is using online ad networks to deliver spyware that can infect devices without any user action. The research found that the company’s software, called Controlium, runs hidden JavaScript when an ad is shown, automatically deanonymising the device and installing malware. The spyware was used to target journalists at Al Jazeera, and to reach devices in national‑security‑sensitive networks such as NATO, the U.S. Department of Defense, Estonia’s Information System Authority, the International Atomic Energy Agency and the International Criminal Court. Discover‑Tech worked with the Israeli spyware firm Candiru, which used the platform to spy on Al Jazeera reporters and other targets.

How the spyware works

The attacks were delivered through millions of ads. Citizen Lab analysed four billion placement records and found that the malicious ads appeared on nearly 200,000 unique websites and on Android and iOS apps. Engadget reports that Discover‑Tech served 442 million ads on more than 120,000 websites, including major news sites and popular apps. The spyware was shown on devices used by military and government organisations, the European Commission, NVIDIA and Arm, and on critical infrastructure.

Google has responded by suspending Discover‑Tech from its ad platforms, citing policy violations. The company’s partner status was removed after the joint investigation with Citizen Lab and Confiant. The incident highlights the lack of regulation in the digital advertising ecosystem and the need for stronger vetting of ad vendors to prevent malware delivery.