An Israeli firm is sending zero-click spyware through online ads
Spyware via Ad-Tech: The Rise of Zero-Click Ad Attacks
Researchers have uncovered a sophisticated operation where an Israeli firm utilizes digital advertising to distribute spyware. This marks the first documented instance of a zero-click attack—a malicious exploit that requires absolutely no interaction from the victim—being delivered through the mechanism of targeted ads.
The Architecture of the Attack
A joint investigation conducted by Confiant and Citizen Lab revealed that an Israeli ad-tech company, Discover-Tech, acted as the delivery vehicle for hacking groups. While the company presents itself as a standard advertising agency masquerades as a legitimate business, it actually functions as a pipeline for deploying malware.
The core of their operation is a platform called Controlium. This system allows spyware partners to identify and infect specific targets with surgical precision.
How Controlium Targets Victims
The platform enables the "de-anonymization" and profiling of millions of users. The following table outlines the identifiers used to select targets for infection:
| Identifier Type | Purpose |
|---|---|
| IP Address | Geographic and network-level targeting |
| Mobile Ad ID | Unique device tracking across apps |
| Browser Identifier | Tracking specific web sessions and browser fingerprints |
Attack Flow Diagram
The Candiru Connection and Al Jazeera
One of the primary partners utilizing this pipeline is Candiru, an Israeli spyware developer that has already been blacklisted by the United States government.
The investigation found that between 2024 and 2025, this partnership was used to target the Qatar-based news organization Al Jazeera.
According to the researchers, the number of compromised devices at the news outlet is estimated as: (At least 45 devices were targeted during this period).
Industry Fallout and Mitigation
Following the report, several major players in the advertising ecosystem took immediate action to sever ties with Discover-Tech:
- Google: Removed the firm from its advertising platforms.
- Beeswax (owned by Comcast): Terminated the firm's access.
- IAB Europe: Suspended the company from its list of approved vendors.
How to Protect Yourself
Citizen Lab and Confiant emphasize that the advertising industry must improve its security protocols. For individuals who believe they are at a high risk of being targeted by state-sponsored spyware, they recommend the following steps:
- Install and use robust ad blockers.
- Disable all forms of ad tracking in system settings.
- Regularly reset your mobile advertising IDs.
Reported by Emma Roth