Security researchers have published the first concrete technical evidence of something experts have warned about for years: mercenary spyware being delivered through ordinary online advertisements, silently infecting phones without the owner clicking anything.
The findings come from the Citizen Lab at the University of Toronto's Munk School, in a report published on 15 October 2026. They centre on an Israeli digital advertising agency, Discover-Tech, and its advertising platform, Controlium — a system the researchers say turns the global ad-targeting infrastructure into a precision weapon for state-linked hackers.
How Controlium turns ads into a precision weapon
The mechanism is disarmingly simple. Discover-Tech has served millions of online adverts worldwide since 2024 — many of them benign promotions for mobile games or telecom services. But when a viewer sees one of these ads, the Controlium platform harvests the device's IP address and identity, effectively de-anonymising and fingerprinting the user in the background.
Once a target has been profiled, third-party spyware firms can push malicious code to the selected device in seconds — with no click, no interaction and no visible sign that anything has happened. The researchers estimate that millions of devices were directed to the servers of the Israeli spyware maker Candiru, where they could be profiled for infection.
The delivered spyware is the full mercenary toolkit: it can extract messages, photographs and emails, record phone calls, and covertly activate the device's microphone. The targets were the usual victims of such surveillance — journalists, government officials, businesspeople and embassy workers.
Careless security exposed the operation
What makes this report significant is the depth of evidence. Citizen Lab researchers found that Controlium's login pages left source code exposed, allowing them to recreate the web-based control panel dashboard without logging in. The dashboard, they say, "appears to be specifically designed to allow them to push malicious content to individual targeted users alongside advertisements."
The researchers also discovered a publicly accessible portion of Discover-Tech's website that let them download login records for the Controlium dashboard without a password. Some of the login details belonged to at least two employees of the spyware maker Candiru — directly linking the ad platform's operations to a known commercial spyware vendor.
Analysis of ad-bidding records publicly exposed on Discover-Tech's site showed the firm's ads — bearing attacker script tags — were displayed across more than 70,000 mobile apps and over 120,000 websites between March and June 2026 alone. Some individual apps displayed more than a million ads linked to the firm.
Who was caught in the net
The network logs of the Qatari broadcaster Al Jazeera proved key to understanding the ad-based nature of the attack: dozens of devices at the broadcaster were believed to have been compromised. The researchers noted that Al Jazeera's network monitoring made the campaign visible — on an ordinary home network, the same infection would have been invisible.
Separate research by the firm Confiant indicates that Discover-Tech's ads reached users on the networks of US and European government entities, NATO, the United Nations, the International Criminal Court and the International Atomic Energy Agency — as well as users in Yemen, Brazil, Mexico and Czechia.
Bill Marczak, a senior researcher at Citizen Lab, summed up the significance: "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action."
Marczak added a sobering caveat about why such campaigns rarely surface publicly: defenders have to be in the right place at the right time, looking at the right data. "If a user's personal device were targeted, say, while they were connected to their home Wi-Fi or mobile data, there's not going to be the same level of network monitoring there. So I think the lack of prior reporting is probably mainly a visibility issue."
A 'nightmare scenario' for the ad industry
The implications go beyond one company. The entire digital advertising ecosystem is built on the premise that ads should be personalised, trusted and embedded everywhere — in apps, websites and connected devices. That trust, the report argues, is precisely what makes it such a powerful attack vector: ad infrastructure reaches nearly every internet-connected device on the planet, operates without specific oversight, and is designed to identify individuals with pinpoint precision.
So-called "malvertising" is not new, but using online ads as the delivery mechanism for powerful government-grade spyware is a notable escalation. It turns a defensive assumption — that spyware requires phishing or social engineering — on its head.
For ordinary users, the practical advice has not changed much, but its urgency has. Security and privacy experts recommend installing ad blockers on desktop and mobile browsers, keeping operating systems and apps updated, and enabling protections such as Apple's Lockdown Mode or Android's advanced protection, which reduce the attack surface available to exploit chains. No defence is perfect against a targeted state-level attack — but raising the cost of infection makes mass or casual targeting far less attractive.
Original reporting on this story appeared in TechCrunch.
Byline: NewsFlow Editorial Team
FAQs
What is zero-click spyware?
Zero-click spyware is malicious software that infects a phone without any action from the owner — no link to tap, no attachment to open, no permission granted. It typically exploits vulnerabilities in the operating system or messaging apps, running silently in the background. Once installed, it can steal messages, photos and emails, record calls and activate the microphone — effectively turning the phone into a surveillance device.
How does the Controlium ad platform work?
Controlium, operated by the Israeli firm Discover-Tech, serves millions of ordinary-looking ads for games and telecom services. When a device displays one of these ads, the platform harvests the viewer's IP address and identity, de-anonymising and fingerprinting the device. Third-party spyware firms can then push malicious code to selected targets in seconds. Citizen Lab found the platform's login pages left source code exposed, allowing researchers to recreate its control panel without logging in — and downloadable login records included at least two employees of the spyware maker Candiru.
Who was affected by the campaign?
Dozens of devices at the Qatari broadcaster Al Jazeera were believed compromised, and the firm's ads appeared across more than 70,000 mobile apps and 120,000 websites between March and June 2026. Impressions were observed on the networks of US and European government entities, NATO, the United Nations, the International Criminal Court and the International Atomic Energy Agency, plus users in Yemen, Brazil, Mexico and Czechia. The typical targets of the delivered spyware were journalists, officials, businesspeople and embassy workers.
Am I personally at risk from this?
This campaign was built for targeted surveillance, not mass exploitation — its victims were people of interest to state-linked spyware clients. Ordinary users are unlikely to have been targeted. But the research shows the ad-delivery mechanism is indiscriminate by design: millions of devices were profiled while only a few were infected. The bigger implication is structural — the same ad infrastructure could theoretically be turned against anyone, which is why experts push for systemic fixes like better ad-tech oversight rather than individual blame.
How can I protect myself?
Experts recommend installing ad blockers on browsers and within apps, keeping phones and apps fully updated, and enabling hardened modes such as Apple's Lockdown Mode or Android's Advanced Protection. These measures raise the cost of exploiting your device, making you a far less attractive target. Against a determined state-level attacker with a fresh vulnerability, no consumer defence is guaranteed — but most people are never such targets, and good hygiene closes off the cheap, easy attack paths.
🤖 This article was rewritten by Feed and Figures' editorial AI from a report originally published by TechCrunch. Facts and quotes are preserved from the original; the rewrite focuses on clarity and structure. For the unedited original, see the source link below.
