An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It’s the first time researchers have found technical evidence of a zero-click attack — a form of hacking that requires no action by users — delivered through targeted advertising, as reported earlier by NBC News.

The ad firm, called Discover-Tech, presents itself as a typical online advertising agency, but researchers say it actually provides a pipeline for hacking groups to plant malicious ads across the web. It operates a platform known as “Controlium” that allows its spyware partners to “precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking,” according to the investigation. It also allows them to “select a user for infection or profiling” using their IP address, mobile ad ID, or browser identifier.

One of the groups Discover-Tech works with is Candiru, an Israeli spyware company that has been blacklisted by the US government. In 2024 and 2025, Discover-Tech ads delivered Candiru-linked spyware to Al Jazeera, a Qatar-based news network. Researchers say the companies targeted “at least” 45 devices at the news outlet in 2024 and 2025.

Citizen Lab and Confiant call on the advertising industry to ramp up security on their platforms. Google and the Comcast-owned advertising company Beeswax have since removed Discover-Tech from their platforms, while IAB Europe suspended the company from its list of approved vendors, Reuters reports. Researchers also recommend that users at high risk of targeting use ad blockers, disable ad tracking, and regularly reset mobile ad IDs.