A sophisticated operation using the machinery of online advertising to deploy invisible spyware has been uncovered by researchers at the University of Toronto. The investigation by Citizen Lab reveals that an Israeli agency called Discover-Tech has been utilizing its proprietary platform, Controlium, to mass profile millions of internet users and selectively infect specific targets. This method represents a dangerous evolution in cyber warfare because it employs zero click technology, meaning victims can have their devices fully compromised without ever clicking a link or downloading a suspicious file.
The process begins within the chaotic, split second auctions that power most modern web ads. As users browse the internet, their personal data is auctioned off to bidders who want to display tailored advertisements. Researchers found that Discover-Tech used these innocuous looking ads for things like mobile games or telecom services to harvest identities and IP addresses. Once a high value target was identified, such as a journalist or government official, malicious code could be sent directly to their device in seconds, granting hackers total access to encrypted messages, emails, photos, and even live microphone feeds.
The scale of the operation appears vast and indiscriminate in its reach. While dozens of devices at the broadcaster Al Jazeera were specifically flagged as compromised, evidence suggests millions of people across Brazil, Mexico, Yemen, and Czechia were served these profiling ads. Further analysis indicates that users on networks belonging to NATO, the United Nations and various European government entities may have also been exposed. This widespread infiltration highlights a critical vulnerability in how the global ad tech ecosystem operates with almost no regulatory oversight.
Security experts are now calling for urgent intervention from lawmakers and cybersecurity agencies to close these systemic loopholes. Because the infrastructure relies on legitimate advertising channels already trusted by browsers and operating systems, detecting these attacks is incredibly difficult for traditional security software. According to those at Citizen Lab, this discovery provides the first concrete technical proof that the opacity of programmatic advertising can be weaponized with pinpoint precision to conduct state level surveillance on a global scale.