Digital advertising can become an intrusion vector without the targeted individual opening an attachment, tapping a link or downloading an app. This is according to a joint investigation by Citizen Lab and Confiant, which found that Discover-Tech, an Israeli online advertising firm, allegedly provided spyware operators with the infrastructure needed to reach selected targets through ordinary web ads.
The case carries particular significance because researchers claim to have found, for the first time, technical evidence of a zero-click attack delivered via targeted advertising. In their reconstruction, the ad is not merely a vehicle to drive the victim to a fraudulent page: it becomes the delivery point for the attack. Simply viewing the ad content is enough to trigger the compromise chain, without any conscious action from the user.
Those affected include Al Jazeera employees. Citizen Lab and Confiant attribute the compromise of at least 45 devices belonging to the Qatari broadcaster to campaigns carried out in 2024 and 2025, linking the software used to Candiru, an Israeli spyware firm already placed on U.S. government restriction lists. The evidence does not turn every online ad into a threat, but it points to a threat vector that is far harder to counter than campaigns relying on phishing and malicious links.
The advertising platform at the center of the investigation
Discover-Tech presents itself as an ad tech company, a sector that develops systems to buy, distribute and measure advertising campaigns. According to the investigation, however, a platform called Controlium operated behind this business, used to identify and reach specific users within the programmatic advertising ecosystem.
The capability described by researchers is the ability to combine identifiers typically used in marketing for surveillance and intrusion purposes. IP addresses, mobile advertising identifiers, and browser data can serve to distinguish one device from another, build a profile, and target the recipient of a specific creative. In a commercial context, these tools serve, for example, to cap campaign frequency or measure performance. If made available to spyware developers, however, they can help pinpoint an individual and deliver hostile content with a precision incompatible with the concept of advertising as mass communication.
This is the most critical aspect of the affair. Advertising platforms are built to know reasonably well who is on the other side of the screen and to decide in milliseconds which ad to display. The model serves the market because it enables targeting and automation; at the same time, should controls fail or an intermediary act maliciously, the very same infrastructure can provide a pathway to reach individual targets on entirely legitimate websites.
In the case described by Citizen Lab and Confiant, Controlium reportedly allowed Discover-Tech partners to select a user for profiling activities or infection. The distinction is significant: gathering device signals can help an operator verify whether the target is indeed the intended one, what software they run, and whether favorable conditions exist to proceed with the attack. Any potential exploit is delivered only when the targeting is deemed sufficiently reliable.
Why a zero-click attack changes the risk level
Zero-click attacks exploit vulnerabilities that require no interaction. They are therefore considered among the most insidious forms of compromise: standard user precautions, such as ignoring suspicious messages or avoiding unknown downloads, are not necessarily enough to stop them. In this case, the decisive factor is exposure to advertising content tailored to a specific device.
Programmatic advertising adds complexity because it involves a long chain of actors: advertisers, agencies, demand- and supply-side platforms, verification systems, ad networks, and websites hosting ad inventory. An ad can be bought, processed, and displayed almost instantaneously, through steps that are often invisible to both publisher and reader. Such speed makes it difficult to inspect every creative and post-impression behavior, especially when a threat actor uses seemingly ordinary advertising mechanisms to single out a victim.
The investigation links Discover-Tech to Candiru, a well-known name in the commercial surveillance tools market. Candiru was added to the US Entity List in 2021 alongside NSO Group: a measure that restricts access to US technologies without government authorization. However, the new case does not concern only the spyware vendor. It draws attention to the role of those who can provide data, ad distribution, and targeting capabilities—the very components that make selective intrusion feasible outside the channels traditionally associated with malware.
Moreover, Al Jazeera represents a target consistent with the intelligence value that journalists and newsrooms can hold for surveillance operations. A compromised device can expose communications, sources, movements, and work documents. Available sources do not detail what data, if any, was exfiltrated, nor do they identify the ultimate perpetrators behind the campaigns; the finding verified by researchers concerns the existence of the technical chain and the minimum number of affected devices at the broadcaster.
Industry reactions and potential countermeasures
Following the reports, Google and Beeswax, an advertising company owned by Comcast, removed Discover-Tech from their respective platforms. IAB Europe also suspended the company from its list of approved vendors. These measures may curb the company's access to part of the advertising ecosystem, but on their own they do not eliminate the structural problem highlighted by the investigation: the availability of identifiers and targeting systems can be exploited across a supply chain made up of numerous interconnected services.
Citizen Lab and Confiant are calling on the industry to tighten checks. The request goes beyond merely removing flagged entities, calling into question the vetting procedures for advertisers, the oversight of tech vendors, and the monitoring of anomalous campaign behavior. For platforms and publishers, this means evaluating not just the visible content of an ad, but also domains, redirects, scripts, and the ways profiling data is utilized.
For high-risk users—such as journalists, activists, researchers, and individuals operating in sensitive environments—researchers suggest several defensive measures: using ad blockers, disabling ad tracking, and periodically resetting their phone's advertising identifier. These precautions reduce profiling opportunities, but offer no absolute guarantee against zero-click exploits. Protection ultimately remains tied to how swiftly operating systems, browsers, and applications receive security updates.
The report substantiates a concern already looming over digital advertising: data collected to personalize commercial messaging can carry consequences that go far beyond marketing. In this case, the researchers' reconstruction suggests that the infrastructure designed to find the right audience was repurposed to pinpoint the right device to target. The supply chain's response will determine whether the removal of Discover-Tech remains an isolated measure or triggers a deeper overhaul of controls over intermediaries, identifiers, and ad targeting.
