Online Advertisements Used to Spread Secret Spyware

A new report from researchers at the University of Toronto’s Citizen Lab has revealed a worrying trend in digital security. According to The Guardian Technology, an Israeli advertising agency called Discover-Tech has been serving millions of online advertisements that allow “zero-click” spyware to be used against specific targets. Unlike traditional malware that requires a user to click on a suspicious link or open a dangerous file, this new method works without any interaction from the victim. The spyware is installed automatically in a matter of seconds, often without the user ever knowing.

Ars Technica reports that this campaign, which researchers named AdFection, is particularly dangerous because it is invisible to the average person. The spyware can only be found if the user runs special forensic software or hardware. Citizen Lab confirmed that this method was used to infect 45 devices at an international media organization during 2024 and 2025. Because the infection happens silently, it is very difficult for victims to protect themselves.

To understand how this works, it is important to look at how online advertising functions. When a person visits a website or uses an app, their device information is sent to a system that decides which ads to show. This happens in a split second through an automated auction. According to Ars Technica, Discover-Tech acts as a bridge between this advertising system and mercenary spyware companies. By using unique mobile IDs, location data, and IP addresses, these companies can build detailed profiles of millions of people. Citizen Lab stated that they reviewed over 4 billion bidding records handled by Discover-Tech, showing that these ads appeared on over 70,000 mobile apps and 120,000 websites between March and June 2026.

The Guardian Technology notes that Discover-Tech operates a platform called Controlium. This software allows clients to identify and track internet users before secretly sending malicious code to their devices. Once the spyware is installed, it can access almost everything on a phone or computer. This includes reading private messages, viewing photos, checking emails, and even recording phone calls or activating microphones. Researchers say this technology has been used to target government officials, journalists, business leaders, and activists in many countries, including Yemen, Brazil, Mexico, and Czechia.

The reach of this threat extends far beyond private individuals. Related research by the group Confiant suggests that these malicious ads have been shown to users within important organizations, such as the United Nations, NATO, and the International Atomic Energy Agency. Wolfie Christl, a researcher at Citizen Lab, described the situation as disastrous. He noted that major advertising companies have been unable to detect or stop these malicious operations for years. According to Christl, the current way the online advertising industry works is a security threat to everyone, including governments and civil society.

This discovery highlights a growing problem in the digital world. While many people know that ads can be used to track their interests, the ability to use these ads to deliver “zero-click” exploits is a major shift in how hackers operate. Bill Marczak, a researcher at Citizen Lab, explained that while there has been much talk about ads being used to identify and hack targets, this is the first time there is concrete technical evidence of the process in action. As the evidence grows, it is becoming clear that the hidden systems behind online advertising are being used for surveillance on a massive scale.

For news organizations and other groups, this serves as a serious warning. Citizen Lab researchers stated that newsrooms should be aware that their staff members are potential targets for this kind of attack. As this technology continues to evolve, the challenge for security experts will be to find ways to protect users from a threat that is designed to be invisible. For now, the report serves as a reminder that even a simple, harmless-looking advertisement on a website could potentially be a gateway for someone to take control of a personal device.