Israeli firm Discover-Tech secretly turned everyday online ads into 'zero-click' spyware weapons, researchers reveal

Citizen Lab researchers have confirmed for the first time that an Israeli advertising company called Discover-Tech turned the global online ad network into a covert pipeline for government-grade spyware that infects phones and computers the moment an ad loads — without any click from the victim. The technique, dubbed AdFection, allowed spyware makers including US-blacklisted Candiru to silently compromise at least 45 devices belonging to journalists and staff at Al Jazeera. Discover-Tech's ads reached nearly 200,000 websites and apps, and also appeared on networks belonging to NATO, the US Department of Defense, the European Commission and the International Atomic Energy Agency.

Google has now suspended Discover-Tech from its global vendor list after a joint investigation with Citizen Lab and Confiant confirmed systematic policy violations.

Citizen Lab senior researcher Bill Marczak warned the findings are 'surely just the tip of the iceberg' of how online ads are being weaponised for espionage at massive scale.

At least two zero-click spyware makers, Candiru and Bindecy, are alleged to have used Discover-Tech's Controlium platform to identify, track and silently hack targets worldwide.