An Israeli ad tech firm, Discover-Tech, has been found to be collaborating with spyware companies to secretly install malicious software on devices through online ads, according to a joint investigation by security researchers at Citizen Lab and Confiant. This is the first known instance of a zero-click attack being delivered through targeted advertising, raising serious concerns about the security of online platforms.

The firm operates a platform called Controlium, which allows spyware partners to precisely target and infect devices with no user action required. In 2024 and 2025, Candiru, an Israeli spyware company blacklisted by the US government, delivered spyware via Discover-Tech’s ads to Al Jazeera, a news network based in Qatar. The researchers found that at least 45 devices at Al Jazeera were targeted.

In response, Google and the advertising company Beeswax removed Discover-Tech from their platforms, while IAB Europe suspended the company from its list of approved vendors. Researchers advise high-risk users to use ad blockers and regularly reset their mobile ad IDs to mitigate potential threats.

The incident highlights the growing complexity of online security and the urgent need for the advertising industry to implement stronger security measures.