Security researchers at The Citizen Lab, a digital rights unit at the University of Toronto, have uncovered a worrying new method of cyber espionage. They claim that an Israeli company, Discover-Tech, is using global advertising networks to silently hack devices through malicious online adverts. The researchers say this is the first confirmation of zero-click government-backed spyware attacks being delivered via ads.

One attack targeted at least 45 Windows computers at the media organization Al Jazeera. The devices were hacked via Candiru’s spyware after being exposed to online ads packed with malicious code. While it's not clear which governments are behind these attacks, the scale and method of this new threat are alarming.

The researchers found that Discover-Tech’s platform, called Controlium, left some of its source code exposed on its login pages, allowing the researchers to recreate its web-based control panel dashboard. This dashboard appears to be specifically designed to push malicious content to individual targeted users alongside advertisements. The company’s website also had a publicly accessible portion allowing the researchers to download extensive user login records for the Controlium dashboard.

Security experts are urging people to disable ad tracking on their devices or even block ads altogether. While such so-called ‘malvertising’ attacks are not new, using online ads to allow powerful government spyware to silently hack into devices is a notable escalation. The internet, once a bastion of freedom, may now be a covert battleground.