Citizen Lab Documents First Public Case of Zero-Click Spyware Delivered Through Targeted Ads
Citizen Lab reports the first public case of zero-click spyware delivered via targeted ads, affecting Al Jazeera devices.
The Guardian reported that Citizen Lab believed the devices were compromised by spyware delivered through ads run by Discover-Tech, which describes itself as a specialized digital advertising agency. According to Citizen Lab, Discover-Tech operates a software platform called Controlium that allows clients to "mass-profile and deanonymize" internet users and then covertly hack targets with third-party spyware.
Unlike spyware infections that rely on victims interacting with links or files, the spyware described by Citizen Lab requires no action from the victim to be installed, the researchers said. Citizen Lab said the infections happen without a user's knowledge and in a matter of seconds.
"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a researcher at Citizen Lab.
The report says Controlium can harvest a user's identity and IP address when the user is shown a seemingly benign custom-created ad, such as one for a digital game or a telecoms service. If the user has been selected as a hacking target, a mercenary spyware firm can then send malicious code containing spyware to the device, according to the researchers.
Citizen Lab said millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia. The full extent of the targeting allegedly enabled by Discover-Tech is unknown.
The report says the online advertising ecosystem "is being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware." Citizen Lab's findings add to mounting evidence that the opaque arrangements underpinning online advertising can be leveraged for surveillance, according to the report.
Editor's Summary Citizen Lab says it has documented the first publicly confirmed case of zero-click mercenary spyware delivered through targeted online ads, a technique it calls AdFection, and believes dozens of Al Jazeera devices were compromised via ads run by Discover-Tech. The case adds technical evidence to longstanding concerns that online advertising infrastructure can be used for surveillance and covert device infection.