Citizen Lab uncovers use of targeted online ads to deliver zero

Researchers at Citizen Lab have documented the first publicly confirmed use of targeted online advertising to deliver zero-click spyware.

According to Citizen Lab , Discover-Tech operates a platform called Controlium, which connects digital advertising infrastructure with commercial surveillance technologies. The platform allows clients to identify and profile internet users through advertising identifiers, IP addresses and other device information, and to select particular devices for further surveillance or potential infection.

Citizen Lab’s forensic investigation identified a series of attacks targeting at least 45 devices associated with the international broadcaster Al Jazeera in 2024 and 2025. The researchers attributed these attacks with high confidence to spyware developed by Candiru, an Israel -based commercial spyware company now operating under the name Integrity Labs. The spyware was delivered through Discover-Tech’s advertising infrastructure.

Citizen Lab also identified connections between Discover-Tech and other commercial surveillance companies, including Bindecy and Intelos. Its investigation documented a separate operation, attributed to a threat actor it calls DARK CARTOGRAPHER, which allegedly exploited vulnerabilities in mobile telecommunications networks to associate advertising identifiers with telephone numbers. The researchers indicated that further technical findings this operation would be published separately.

Following the researchers’ disclosures, several advertising companies and industry organisations took measures to restrict Discover-Tech’s access to their services. According to Citizen Lab’s report, Google terminated the company’s access to its advertising exchange platforms and introduced Safe Browsing protections for domains associated with the operation. The Interactive Advertising Bureau Europe (IAB Europe) removed Discover-Tech from its approved vendor listings, while Beeswax, owned by Comcast, removed its access. Vungle (Liftoff) suspended the company pending a review, and Eskimi blocked associated accounts and domains.

Discover-Tech had previously appeared on approved advertising vendor lists. As documented in Citizen Lab’s investigation, Beeswax explained to the researchers that the malicious code was difficult to detect through conventional advertising verification because different content could be delivered depending on the device and user being targeted. This raises questions the ability of existing advertising verification mechanisms to identify similar activities.

In reported by The Guardian , Citizen Lab researcher Bill Marczak discussed the significance of obtaining technical evidence demonstrating how online advertising infrastructure could be used to identify and automatically compromise specific devices. Researcher Wolfie Christl called for cybersecurity authorities, regulators and lawmakers to investigate the companies involved and address vulnerabilities in the advertising ecosystem.

According to Citizen Lab, this is the first publicly documented case of targeted online advertising being used to deliver zero-click commercial spyware. While the use of advertising infrastructure to track and profile individuals is well established, the investigation provides evidence of how these systems can also be used to deliver spyware without requiring any interaction from the targeted person. The findings illustrate how information collected through advertising networks, including device identifiers, IP addresses and browsing activity, can facilitate both the identification of potential targets and subsequent attempts to compromise their devices.

The case is relevant to discussions privacy and data protection , cybersecurity and the regulation of commercial surveillance technologies. It raises questions the responsibilities of advertising platforms and intermediaries, particularly regarding access to device information, the verification of advertising partners and the detection of malicious code distributed through advertising networks. The findings also highlight the potential implications for journalists, government institutions and other individuals or organisations exposed to targeted surveillance.

The responses from advertising companies demonstrate that existing mechanisms can be used to restrict access once potentially malicious activities are identified. However, the investigation raises questions the effectiveness of preventive safeguards, particularly where advertising content can be modified according to the device or individual receiving it, making malicious activity more difficult to detect through conventional verification processes.