Israeli Ad Firm Helped Spyware Makers Hack Targets Through Ads, Researchers Say

Digital rights researchers at the University of Toronto’s Citizen Lab said Thursday that an Israeli company presenting itself as an ordinary advertising firm let makers of mercenary spyware use its ad platform to aim malicious code at specific people, infecting devices without the victims clicking anything.

In a report it calls the first public technical confirmation of so-called zero-click spyware delivered through online ads, Citizen Lab said the company, Discover-Tech, operated a platform called Controlium that allowed customers to target individuals by their phone’s advertising identifier, browser identifier or internet address with “controlled ads” capable of carrying malicious code. The research was conducted with Confiant, a company that monitors the quality of online advertising, which published a parallel analysis.

The researchers linked the scheme to two spyware vendors. They tied attacks on at least 45 devices at the news network Al Jazeera in 2024 and 2025, with high confidence, to spyware from Candiru, an Israeli firm that has rebranded as Integrity Labs, delivered through Discover-Tech ads. They also connected a second spyware maker, Bindecy, to the platform through accounts that logged into Controlium.

The scale of the exposure was large. Citizen Lab said it analyzed nearly 4 billion advertising bid records left exposed on a Discover-Tech server, covering March through June 2026. Ads containing the attackers’ code appeared across roughly 200,000 apps and websites in dozens of countries. Bidding records show ads were served to devices used by militaries, governments, critical infrastructure operators and national cyber agencies, though it is not clear whether those led to infections. Confiant found signs that the ads were displayed on networks of the International Atomic Energy Agency and the International Criminal Court, which Citizen Lab did not independently confirm.

“Surely just the tip of the iceberg,” Bill Marczak, a Citizen Lab researcher, said of Discover-Tech.

Several companies in the advertising supply chain cut off Discover-Tech after being contacted, the report said, including Google and the industry group IAB Europe, both of which removed it from vendor lists this month. Bindecy did not respond to Citizen Lab’s request for comment, the report said. TechCrunch reported that Discover-Tech and Al Jazeera did not respond to requests for comment and that Integrity Labs could not be reached.

The findings matter because online advertising reaches almost every phone and computer, and targeted ads can be aimed with precision at a single device. In the industry’s favor, several of the companies involved moved to cut off Discover-Tech once researchers alerted them, and most online ads carry no such code. The harder question the report raises is how little the companies that sell ad targeting know about who is buying it.

Citizen Lab called on regulators to investigate whether Discover-Tech and Candiru broke the law, and offered recommendations for lawmakers, security teams and the advertising industry to block similar attacks.