An Israeli ad company, DiscoverTech, has for years been secretly helping spyware developers place their hacking software on popular websites, researchers at Citizen Lab say, resulting in a cyberattack that targeted at least 45 devices at the news outlet Al Jazeera.
asserted
that → help → outlet
The findings, documented in a report published Thursday by Citizen Lab, are the first time cybersecurity experts have shown how online ad platforms, so common across the internet that they are inescapable, can be used as a vector to hack visitors’ devices without their knowledge.
asserted
they → document → knowledge
“Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” said Natalia Krapiva, a spyware expert at the digital rights nonprofit Access Now, who read the report and was not involved with its research.
asserted
who → browse → research
“States and tech companies whose infrastructure is used to conduct these attacks need to take urgent technical, legal and regulatory measures.”
asserted
infrastructure → use → measures
The report is a joint effort between Confiant, a U.S. ad security company, and the Citizen Lab, a University of Toronto operation that researches mercenary spyware computer programs.
asserted
that → research → programs
Spyware is often leased to governments around the world to help them hack devices of people they want to spy on.
asserted
they → lease → people
While spyware companies often tout their products as crucial tools for governments to enforce national security, the tech has repeatedly been used around the world to crack down on journalists, human rights advocates and political opposition.
asserted
tech → tout → journalists
DiscoverTech is a Tel Aviv company that sells online advertising services, the report said.
asserted
report → sell → services
“We take pride in providing our clients with a gateway to global fraud-free traffic, connecting your brand with real users,” its site says.
asserted
site → take → users
DiscoverTech is one of a number of companies that help brands show their advertisements on websites that may be visited by potential customers.
uncertain
that → help → customers
But the company secretly ran a separate program, the report says, that allowed spyware companies to inject malicious software onto visitors’ devices.
asserted
companies → run → devices
The malicious code used to hack Al Jazeera computers was particularly effective, the researchers said, because it was “no-click” spyware — meaning a victim did not need to download a file or even click a link to be infected, just visit a website with a vulnerable computer and see the ad.
asserted
victim → use → ad
The hacks, which were not previously reported until the release of the Citizen Lab’s report, occurred in 2024 and 2025.
asserted
which → report → 2024
Al Jazeera provided the Citizen Lab with network logs from the period of the attacks, which researchers used to reconstruct how they unfolded, the Citizen Lab said in the report.
asserted
Lab → provide → report
It previously reported that the phones of 36 Al Jazeera journalists and staff members had been hacked with what it said was Pegasus spyware made by a different Israeli company, NSO Group, most likely by operators linked to Saudi Arabia and the United Arab Emirates.
asserted
it → report → Arabia
NSO said at the time that it would review the findings.
asserted
it → say → findings
Al Jazeera did not respond to a request for comment.
asserted
Jazeera → respond → comment
Neither did DiscoverTech and its CEO.
asserted
DiscoverTech → do → ?
Like many advertising platforms, DiscoverTech has a wide reach: The report said it serves ads on almost 200,000 websites, Android apps and iOS apps, including those of major media organizations, search engines, government agencies and dating services.
asserted
it → have → organizations
The report says Confiant detected DiscoverTech ads served on networks of major government entities like those of the U.S. Defense Department and the Dutch Economic Affairs Ministry, though it emphasized that the presence of ads does not indicate those organizations were targeted in malicious campaigns.
asserted
organizations → say → campaigns
Five ad vendors and industry organizations responded to the Citizen Lab’s findings by disconnecting DiscoverTech from their platforms.
asserted
vendors → respond → platforms
A Google spokesperson told NBC News that Google had helped the Citizen Lab and Confiant in their investigation and affirmed their findings, saying DiscoverTech is now banned on Google Ads.
asserted
DiscoverTech → tell → Ads
A spokesperson for IAB Europe, the continent’s largest trade organization for the advertising industry, said it has suspended DiscoverTech from its platforms.
asserted
it → say → platforms
The report said the ad platforms Beeswax, Vungle and Eskimi took similar action.
asserted
report → say → action
The online advertising industry is a vast, convoluted and largely unregulated system that relies on maintaining significant technical information about people.
asserted
that → rely → people
Websites rarely directly control which companies post ads on their sites.
asserted
companies → control → sites
Instead, advertisers preprogram “bids” for every person who visits and often prefer to advertise to people matching certain characteristics so their ads can be more targeted.
asserted
ads → preprogram → characteristics
The industry usually refrains from collecting specific personal information on people, but it assigns them industry “advertising IDs” and ties information like age, sex, location and preferences to them.
asserted
it → refrain → them
The researchers say DiscoverTech taps into that system to offer a secret program called Controlium, which allows spyware companies to use DiscoverTech’s ad network to identify people to hack and help them deliver the malicious code to take over their devices.
asserted
them → say → devices
Controlium is not mentioned on DiscoverTech’s website, but researchers say they found source code on its login pages and were able to view aspects of how the program works.
asserted
program → mention → aspects
It allowed users to pick specific people to infect or profile using their phones’ advertising IDs, browser identifiers or IP addresses, numbers assigned to internet connections that can help tie people to locations such as their homes.
asserted
that → allow → homes
The researchers found that Candiru, an Israeli spyware company that now operates as Integrity Labs, used DiscoverTech’s ads to deliver its spyware.
asserted
that → find → spyware
The U.S. Commerce Department added Candiru to its Entity List in 2021, saying foreign governments had used its software to target journalists, activists and government officials.
asserted
governments → add → journalists
Wolfie Christl, one of the Citizen Lab researchers behind the report, said it illustrates something cybersecurity experts have long warned about: that the murky online advertising industry can be a vector for hackers to target victims and that most people should consider ad blocking software to be an essential cybersecurity tool.
asserted
software → say → victims
But even that is not foolproof, he said.
asserted
he → say → ?
“I think that our findings confirm once again that ad blocking must be considered a cybersecurity best practice.
asserted
blocking → think → ?
However, as ad blockers often try to balance protection and usability, they might still not consistently protect from malicious ads and other malicious code,” Christl said.
uncertain
Christl → try → ads
“We recommend resetting or disabling the so-called Advertising ID on mobile devices and using opt-out features of apps.
asserted
We → recommend → apps
Generally, it’s difficult, if not almost impossible, to consistently protect yourself from malicious ads,” he said.
asserted
he → ’ → ads
The Aporia
