Researchers Link Israeli Ad Firm to Zero-Click Spyware Attacks on Al Jazeera Staff
A joint investigation reveals an ad tech platform facilitated zero-click infections via targeted ads, affecting at least 45 devices at the news network.
Key points
- Discover-Tech’s Controlium platform enabled zero-click spyware delivery through online ads.
- Researchers identified at least 45 infected devices at Al Jazeera in 2024 and 2025.
- Google, Beeswax, and IAB Europe have removed or suspended the firm from their systems.
Security researchers from Citizen Lab and Confiant reported that an Israeli advertising technology company collaborated with spyware developers to infect devices using zero-click attacks. The investigation found that these infections occurred simply by displaying online ads to targets, requiring no interaction from the users. This marks the first time technical evidence has been found of a zero-click attack delivered through targeted advertising, according to the joint report.
The firm, known as Discover-Tech, operates a platform called Controlium. Researchers stated that this platform allows spyware partners to profile individuals, fingerprint devices, and execute zero-click hacks. The system enables attackers to select specific users for infection based on IP addresses, mobile ad IDs, or browser identifiers. This capability provides a precise pipeline for targeting individuals across the web.
How the Attack Operated
Discover-Tech presents itself as a standard online advertising agency. However, the investigation concluded that it functions as a conduit for hacking groups to distribute malicious ads. The Controlium platform facilitates the de-anonymization of millions of individuals. This process allows partners to track users and deliver spyware without any clicks or actions from the victim.
One of the primary partners identified is Candiru, an Israeli spyware company blacklisted by the US government. The researchers found that Discover-Tech ads delivered spyware linked to Candiru. This collaboration demonstrates how legitimate advertising infrastructure can be abused to bypass traditional security measures that rely on user interaction for triggering exploits.
Impact on Al Jazeera
The investigation highlighted specific targeting of Al Jazeera, a news network based in Qatar. Researchers determined that during 2024 and 2025, at least 45 devices at the news outlet were infected. These infections were the result of targeted advertising campaigns delivered through the Discover-Tech platform. The scope of the attack suggests a sustained effort to compromise the organization's digital infrastructure.
Major advertising industry players have responded to the findings. Google and Comcast-owned Beeswax have removed Discover-Tech from their advertising platforms. Additionally, IAB Europe suspended the company from its list of approved vendors. These actions reflect growing concern over the security implications of ad tech pipelines that enable such sophisticated attacks.
What should you do?
Researchers recommend that individuals at high risk of targeting take specific steps to reduce exposure. They advise using ad blockers to prevent the display of potentially malicious advertisements. Disabling ad tracking features on devices can also limit the ability of attackers to profile and target users. Regularly resetting mobile ad IDs is another recommended measure to disrupt tracking mechanisms used in these attacks.
What to do and how to stay safe: Discover-Tech
- Install and maintain reputable ad blockers to prevent the loading of potentially malicious advertising content.
- Disable personalized ad tracking settings on operating systems and browsers to reduce fingerprinting capabilities.
- Regularly reset mobile advertising identifiers to disrupt long-term profiling efforts by tracking networks.
- Monitor official security advisories for updates on specific ad tech vendors or spyware campaigns affecting your industry.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is a zero-click attack?
A zero-click attack is a form of hacking that requires no action by the user to install malware or spyware on a device.
Which organization was targeted by this specific campaign?
Researchers found evidence of at least 45 infected devices at Al Jazeera between 2024 and 2025.
What happened to Discover-Tech after the investigation?
Google and Beeswax removed the firm from their platforms, and IAB Europe suspended it from its approved vendor list.
