Researchers described their findings as the first public documentation of the use of targeted advertising to deliver commercial spyware via "zero-click" attacks, which can allow devices to be compromised without any user interaction.
How do ads turn into a tool for espionage?
Digital advertising relies on a real-time bidding system, which allows advertisers to compete to display personalized ads to users within fractions of a second. During this process, massive amounts of ad requests are processed, and technical data that may reveal certain browsing patterns, interests, and device-related information are exchanged.
According to the investigation, Discover-Tech's "Controlium" platform, along with ad identifiers, IP addresses, and other technical data, was used to help identify targeted users and devices.
An ad, whether it appears on a website or within an app, may contain code that communicates with external servers and sends them technical data. The appearance of an ad does not necessarily mean the device is infected, but this infrastructure can be exploited to identify specific targets and attempt to deliver malicious software to them.
Hacking without a single click
Unlike traditional phishing attacks that rely on convincing the victim to open a link or download a file, "zero-click" attacks may begin as soon as content is loaded that exploits a security vulnerability in the device or one of its programs, without requiring any action from the user.
According to the report, the process begins with the ad appearing and connecting to the advertising infrastructure, then the device data is evaluated according to targeting criteria. If the data matches the desired target, additional code may be sent that leads to exploiting a security vulnerability and running the spyware.
These programs may allow access to sensitive information, such as messages, files, and personal data, depending on the vulnerabilities exploited and the permissions they are able to obtain.
The danger of this type of attack is compounded by the difficulty of noticing it; the user may not see any clear signs of a breach, and the appearance of a malicious ad on a well-known site does not necessarily mean that the publisher intended to display it, as one of the intermediary companies in the ad distribution chain may be the point of exploitation.
Targeting 45 devices in the Al Jazeera network
One of the most prominent findings of the investigation is the link between attacks that targeted at least 45 devices within the Al Jazeera network during 2024 and 2025 and spyware developed by the company "Candiru," with a degree of confidence that researchers described as high.
The researchers relied on network logs provided by Al Jazeera, which revealed a sequence of connections that began with domains linked to the advertising infrastructure, then moved to an infrastructure linked to the spyware, which allowed for the reconstruction of the attack path and the linking of its stages.
Al Jazeera condemned the attacks that targeted a number of its employees, confirming that it continues to work to protect its staff and systems, and stressing that targeting journalists represents an assault on press freedom and calls for holding those responsible accountable.
However, the investigation does not prove that all users of the websites and applications that displayed the ads were compromised, nor does it definitively identify the party that ordered the targeting of Al Jazeera's devices.
A vast advertising network and measures against the company
The results of the analysis showed that ads linked to Discover-Tech reached a wide range of the internet. Media reports indicated that these ads appeared on more than 120,000 websites and 75,000 applications.
But this prevalence does not mean that all devices that displayed the ads were infected; rather, it indicates the breadth of the channels that could have been exploited to reach potential targets.
Following the publication of the investigation's findings, advertising companies and platforms took measures against Discover-Tech. Reports stated that Google suspended the company from its advertising platforms, while other entities suspended their dealings with it or removed it from their lists of approved suppliers.
These measures highlight the importance of auditing the intermediary companies involved in ad distribution, but they do not necessarily mean the removal of all traces of previous activity or the end of the risks associated with it.
How do you protect your devices?
Although a user cannot prevent all advanced attacks on their own, taking a set of measures may reduce the risks, most notably:
Constantly updating devices: Installing operating system and application updates to patch known security vulnerabilities.
Reducing ad tracking: Reviewing privacy settings and ad identifiers and limiting the sharing of unnecessary data.
Using trusted tools: Utilizing reliable ad-blocking and tracking-prevention tools, while being aware that they do not block all attacks.
Monitoring suspicious activities: Paying attention to unusual connections, data consumption, and abnormal device behavior, knowing that the absence of these signs does not rule out a breach.
Enhancing account protection: Enabling multi-factor authentication and using strong, unique passwords.
As for media organizations and entities that handle sensitive information, they need to monitor network traffic, scan suspicious devices, and develop clear plans for responding to security incidents. These measures are particularly important for journalists, because the compromise of their devices could lead to the exposure of their sources, correspondence, and professional files.
A responsibility that goes beyond the user
This case reveals that digital advertising, which was designed to personalize content and reach the target audience, can, when misused, turn into a channel for delivering spyware and executing cyberattacks.
It also confirms that confronting this threat does not fall on the user alone, but requires stricter oversight of advertising companies and technical intermediaries, improving mechanisms for detecting malicious ads, and enhancing transparency and accountability in the digital ad distribution chain.
