Israeli Ad Tech Firm Used Online Ads to Deploy Spyware in Zero-Click Attacks, Researchers Find

An Israeli advertising technology firm secretly provided a pipeline for spyware companies to infect devices by simply displaying online ads to targeted users, according to a joint investigation published in October 2026 by security researchers at Citizen Lab and Confiant.

The firm, called Discover-Tech, presents itself as a conventional online advertising agency. Researchers say it operates a platform called “Controlium” that allows spyware partners to profile and de-anonymize individuals, fingerprint their devices, and target them using IP addresses, mobile ad IDs, or browser identifiers. The investigation marks the first time researchers have found technical evidence of a zero-click attack — a form of hacking that requires no action from the user — delivered through targeted advertising.

One of Discover-Tech’s partners is Candiru, an Israeli spyware company that has been blacklisted by the US government. Between 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, a Qatar-based news network. Researchers say at least 45 devices at the outlet were targeted during that period.

Following the investigation’s findings, Google and Beeswax — an advertising company owned by Comcast — removed Discover-Tech from their platforms. IAB Europe also suspended the firm from its list of approved vendors, according to Reuters.

Citizen Lab and Confiant called on the broader advertising industry to strengthen security on their platforms. For individuals considered high-risk targets, researchers recommend using ad blockers, disabling ad tracking, and regularly resetting mobile ad IDs.

The case suggests that malicious actors may be able to exploit the infrastructure of legitimate online advertising networks to conduct surveillance operations without any interaction required from their targets.