Israeli Firm Used Online Ads for Global Spyware Operation

Israeli digital advertising firm Discover-Tech exploited a vast commercial ad network to collect personal data and deliver mercenary spyware to targeted devices worldwide, according to an investigation published Thursday by Canadian cybersecurity watchdog Citizen Lab and New York-based ad security firm Confiant.

The operation used advertising infrastructure for covert surveillance, allowing operators to identify potential targets, track their online activity, and deliver spyware while evading detection. Confiant described the campaign as highly sophisticated, citing its anti-interception measures and precise targeting capabilities. These companies allegedly exploited commercial advertising inventory across major platforms, including Google, Beeswax, and Russia's Yandex.

Citizen Lab described the campaign as the first public technical confirmation of zero-click mercenary spyware delivered through online advertising, a method researchers called "AdFection." Devices belonging to staff members at international news network Al Jazeera were among those infected through weaponized ad placements, which operated silently without visible pop-ups or suspicious links. At least 45 Al Jazeera devices were targeted during 2024 and 2025.

Discover-Tech operated a specialized system called Controlium that turned routine commercial advertising auctions into a surveillance system. After analyzing 4 billion bidding records, researchers found that the company distributed ads across nearly 200,000 unique websites and mobile apps on Android and iOS devices in dozens of countries over a four-month period. The malicious ads also appeared on networks of government agencies and international organizations, including NATO and the U.S. Department of Defense.