An Israeli advertising agency served millions of online ads allowing “zero-click” spyware to be used against targets, researchers at a Canadian university said.
Citizen Lab, a digital investigations research unit at the University of Toronto, said it believes dozens of devices at the Qatari channel Al Jazeera were compromised by spyware delivered via ads served by Discover-Tech, which describes itself as a specialist digital advertising agency.
According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows its customers to “mass profile and deanonymize” internet users and then covertly hack targets with third-party spyware. Unlike infections that rely on people interacting with links or files, spyware requires no interaction from the victim to be installed, making it a new distribution technique, Citizen Lab explains.
Infections occur without the user’s knowledge and within seconds, according to Citizen Lab.
“(The online advertising ecosystem) is being used on a massive scale to profile millions of users and then silently infect targets with click-less mercenary spyware,” the report said.
According to the report, Controlium is able to collect a user’s identity and IP address when they see a seemingly innocuous, tailor-made advertisement – for example, for a digital game or telecommunications service. If the user has been selected as a target for a hack, a mercenary spyware company can then send malicious code containing spyware to their device, according to the researchers.
They claim that millions of users around the world have received ads from Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia.
Related work from the Confiant research group also suggests that Discover-Tech’s ads were served to users on the networks of government entities in Europe and the United States, as well as the UN, NATO, the International Criminal Court, and the International Atomic Energy Agency.
“It is disastrous that major advertising vendors and organizations have apparently been unable to detect or prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem operates today poses a threat to the security of states, the private sector, civil society and everyone else. »
According to Citizen Lab, Controlium acts as an “enabler” for third-party spyware companies that have targeted “government officials, journalists, businesspeople, activists, academics, and embassy employees.” Citizen Lab claims it can deliver spyware that can access everything on a target’s device, extracting messages, photos and emails, recording calls and secretly activating microphones.
The extent of the targeting allegedly enabled by Discover-Tech is unknown. The Citizen Lab’s findings add to growing evidence that the opaque arrangements that underpin the world of online advertising can be exploited for surveillance.
“There has been a lot of noise that online ads can be used to automatically identify and hack targets with pinpoint accuracy, but now, for the first time, we have real-world technical evidence showing this process in action,” said Citizen Lab researcher Bill Marczak.
Discover-Tech has been contacted for comment.
When a user lands on a website that serves ads, their details become part of a split-second programmatic auction involving dozens or hundreds of companies. These companies automatically bid to place an ad in front of that user.
These bids are based on the user’s profile, which may include information about their device and data compiled on it by tracking their activity across the web. For example, companies with the profile of a 35-year-old man interested in sports betting and cryptocurrencies could bid to show him an ad for an energy drink.
There is little regulation of this automated online marketplace and there is growing evidence that it is being exploited by malicious actors.
Reuters reported that billions of dollars in Meta’s advertising revenue comes from ads for scams, illegal games, pornography and other banned content. In the United States, ICE and other government agencies have purchased software that uses ad tech data to track people’s movements.
“Cybersecurity agencies, regulators and lawmakers in the United States, Europe and other regions must urgently intervene. They must investigate the companies involved and address the systemic risks that enable malicious ad targeting,” Christl said.
Gn bussni
