Israeli firm used ads to enable espionage, Canadian researchers say
Ads left millions open to 'zero-click' spyware attacks, Citizen Lab says
An Israeli advertising agency has placed ads seen by millions of internet users that have left them open to spyware attacks, according to a new report from the University of Toronto's Citizen Lab.
uncertain
that → use → Lab
The report, released on Thursday, alleges that Discover-Tech intentionally operates a platform that allows its "partners to de-anonymize, fingerprint, and automatically infect devices" with spyware.
asserted
partners → release → spyware
Those partners can then "push malicious content to individual targeted users alongside advertisements," it says.
asserted
it → push → advertisements
Over a four-month period, Discover-Tech ads appeared on more than 120,000 websites and more than 75,000 apps in dozens of countries — endangering the security of "national-security-sensitive networks," such as government ministries, armed forces and multilateral organizations such as NATO, according to the report, which was released alongside an affiliated investigation by U.S. cybersecurity firm Confiant.
uncertain
which → appear → Confiant
Ron Deibert, Citizen Lab's director, said the findings are a "worst-nightmare" scenario, with "two poorly regulated and highly abused industries" — targeted advertising and mercenary spyware — coming together.
asserted
industries → say → ?
"It's a recipe for disaster," Deibert told CBC News.
asserted
Deibert → tell → News
"It's global espionage that we've uncovered on a massive scale.
asserted
we → uncover → scale
'Zero-click' attacks
Rights groups have raised concerns for years about companies that sell spyware to anyone, oppressive governments in particular, wishing to spy on the public, journalists, political figures and other perceived critics.
asserted
that → raise → public
Experts also have speculated that what's known as the targeted ad ecosystem — where data brokers and advertising firms bid in real time to place ads on apps and websites — could be used for espionage.
uncertain
brokers → speculate → espionage
But Thursday's report marks the first time researchers have documented how "zero-click" spyware attacks can be enabled by targeted ads, Citizen Lab says.
asserted
Lab → mark → ads
"Zero-click" means that users don't need to click on a link or actively do anything for their devices to be targeted with spyware.
asserted
devices → mean → spyware
"The moment [the ad] is rendered, their device can be hacked, so there's really no defence against this, short of not using a smart phone or [not] connecting to the internet," Deibert said.
asserted
Deibert → render → internet
Such infections can be hard to detect.
asserted
infections → detect → ?
The report said some Discover-Tech ads also appeared on the websites of news outlets, including CBC, BBC and the New York Times.
asserted
ads → say → CBC
But Deibert says there's not much those organizations could have done to prevent it.
uncertain
organizations → say → it
"It's just the advertising ecosystem working as intended," he said.
asserted
he → work → ?
Discover-Tech did not respond to CBC News's requests for comment via a contact form on the company's website.
asserted
Tech → respond → website
Chuck Thompson, the head of public affairs at CBC, said in an email that the public broadcaster's logs have "no trace of having delivered any ads," from Discover-Tech.
asserted
logs → say → Tech
CBC escalated to Google, which operates systems for ad sellers, "to verify and provide answers," he said.
asserted
he → escalate → answers
Al Jazeera targeted
Citizen Lab said it was able to confirm a targeted spyware attack on Al Jazeera: At least 45 of the Qatar-based news outlet's devices were infected with spyware via Discover-Tech's ads in 2024 and 2025, the report said.
asserted
report → target → 2024
When spyware is implanted, the operator behind the hack can take control of the device.
asserted
operator → implant → device
"They can turn on the camera, turn on the microphone, and track someone's geolocation, so it's kind of like God-like capabilities," Deibert said.
asserted
Deibert → turn → capabilities
The researchers linked the zero-click attacks on Al Jazeera "with high confidence" to spyware from Candiru, an Israel-based firm that the report said has rebranded as Integrity Labs.
asserted
report → link → Labs
In 2021, the U.S. Department of Commerce sanctioned Candiru "based on evidence that [it] developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."
asserted
that → sanction → officials
CBC News could not immediately find a way to reach Candiru on Thursday.
uncertain
News → find → Thursday
The Reuters news agency also said its attempts were not successful.
asserted
attempts → say → ?
An Al Jazeera spokesperson condemned the targeting of its staff by such spyware as 'deliberate attack on journalists and on press freedom.'
asserted
spokesperson → condemn → freedom
An Al Jazeera Media Network spokesperson told CBC News in an email that it "strongly condemns the targeting of our staff with mercenary spyware."
"This is a deliberate attack on journalists and on press freedom," the spokesperson said, adding that while Al Jazeera would not speculate on who deployed the spyware, it is calling for "a full, independent investigation to identify those responsible and hold them to account."
asserted
it → tell → account
Push for investigations
Qing Tan, an associate professor at Athabasca University in Alberta, said the Citizen Lab report raises "very concerning" questions, including around personal privacy.
asserted
report → push → privacy
"A majority of people don't realize this could happen to them, so this is a very big issue," he said.
uncertain
he → realize → them
Citizen Lab researchers said their findings should push ad vendors to "significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers."
asserted
findings → say → advertisers
They also called on regulators around the world to "investigate whether the rights of their citizens, as well as applicable privacy and security laws were violated."
To censor the internet, 10 countries use Canadian filtering technology, researchers say
Ontario police may have secretly used controversial Israeli spyware, report finds
- LISTEN
Your phone could easily be tapped by spyware abusers: cybersecurity expert
The Office of the Privacy Commissioner of Canada did not immediately respond to emailed questions about whether it intends to investigate the report's allegations or take any immediate action.
uncertain
it → call → action
A Google spokesperson told CBC News in an emailed statement that it blocked Discover-Tech from its ad platforms "for systematically violating" the company's policies, and that it has set up warnings "to help protect people if they navigate to websites linked to this group," they said.
asserted
they → tell → group
IAB Europe, a European association that develops frameworks for digital marketing and the advertising ecosystem, also said Thursday that Discover-Tech was suspended from its list of global vendors for violating its terms.
asserted
Tech → develop → terms
The Aporia
