A routine online advertisement promoting a mobile game or telecoms service can now unmask a web user and silently infect their device with commercial spyware in seconds—without requiring a single click. According to findings published by Citizen Lab, a digital investigations unit at the University of Toronto, an Israeli advertising firm called Discover-Tech has weaponized standard digital ad networks to facilitate surreptitious surveillance against selected individuals.
The researchers revealed that Discover-Tech operates a platform known as Controlium, which allows clients to mass-profile and deanonymize internet traffic. When a targeted user encounters a seemingly benign advertisement, the platform harvests their identity and IP address, enabling partnered mercenary spyware vendors to deliver malicious payloads directly to the hardware. Citizen Lab reported that dozens of devices belonging to staff at Qatari broadcaster Al Jazeera were compromised using this technique, which allows third-party spyware to extract messages, record phone calls, and secretly activate microphones.
The scope of the operation extends far beyond individual newsrooms. Since 2024, millions of Discover-Tech’s advertisements have circulated globally, reaching users in countries including Brazil, Mexico, Yemen, and Czechia. Complementary research by cybersecurity group Confiant revealed that these ads also surfaced on internal networks utilized by the United Nations, NATO, the International Criminal Court, and various government agencies across Europe and the United States.
The revelation provides the first concrete technical proof that the automated, split-second ad auctions underpinning the modern internet have been harnessed for targeted espionage. Describing the opaque ad-tech ecosystem as a systemic security threat to civil society and governments alike, Citizen Lab researchers urged international regulators and cybersecurity agencies to urgently step in and address the structural risks that permit advertising infrastructure to be repurposed for state-level surveillance.