How a Routine Ad Became an Attack Vector
Most people scroll past online advertisements without a second thought. A banner for a mobile game or a telecoms bundle feels harmless, the kind of background noise that funds the free websites we visit every day. New research from Citizen Lab, the digital investigations unit at the University of Toronto, suggests that this assumption may no longer hold. The group says an Israeli advertising agency, Discover-Tech, has been using its ad network to profile millions of internet users and quietly push spyware onto selected targets, including devices belonging to staff at the Qatari broadcaster Al Jazeera.
The technique at the centre of the report is known as zero-click delivery. Traditional infections typically depend on someone opening a suspicious attachment or tapping a dodgy link. Here, according to the researchers, the victim does nothing at all. Simply loading a page that displays a specially prepared ad can be enough for malicious code to be installed within seconds, leaving the person unaware that anything has happened.
Why the Ad Ecosystem Is So Hard to Police
To understand why this is possible, it helps to look at how online advertising actually works. Each time a page loads an ad slot, a split-second auction takes place in which dozens or even hundreds of companies bid for the chance to show a message to that visitor. Their bids are informed by profiles built from device details and browsing behaviour gathered across the web. Citizen Lab says Controlium, Discover-Tech’s platform, exploits this process to identify and deanonymise individuals before handing them to third-party spyware firms.
The scale is what makes the findings unsettling. Researchers say millions of users in countries including Yemen, Brazil, Mexico and Czechia have been served Discover-Tech ads since 2024. Related analysis by the firm Confiant indicates that the same ads reached people on government networks in Europe and the United States, as well as systems linked to the United Nations, NATO, the International Criminal Court and the International Atomic Energy Agency. Wolfie Christl of Citizen Lab called it disastrous that major ad vendors apparently failed to detect the operation for years, and that concern is hard to dismiss.
What Comes Next for Regulators and Users
Advertising has long been criticised for its opacity, and this case gives critics a concrete example of what that opacity can hide. Citizen Lab’s Bill Marczak described it as the first concrete technical evidence of ads being used to automatically hack targets with pinpoint precision. Discover-Tech has not yet responded publicly to the allegations, and the full extent of the targeting remains unknown. Calls are growing for cybersecurity agencies and lawmakers in the United States, Europe and elsewhere to investigate the companies involved and tighten rules around automated ad bidding. Similar concerns have already surfaced around scam advertising and government purchases of ad-derived location data, suggesting that the problem is systemic rather than isolated.
For ordinary people, the practical lessons are still taking shape. Keeping devices fully updated, using browsers with strong tracking protection, and considering ad blockers are sensible defences, though none offers complete protection against a threat that needs no click at all. For businesses and public bodies, the message is sharper: ad inventory is now part of the attack surface and deserves the same scrutiny as any other software supply chain. As consumers increasingly weigh privacy features when choosing phones, browsers and smart devices, demand for hardware and software that limits silent data collection is likely to grow, and vendors who can credibly promise stronger protection may find that security itself has become a selling point.
