Citizen Lab, a digital investigations research unit at the University of Toronto, has released findings indicating that Discover-Tech, an Israeli advertising agency, has been operating a platform called Controlium that facilitates the delivery of spyware through online advertisements. The platform allegedly allows clients to profile and deanonymise internet users before covertly infecting targeted devices with third-party spyware.
According to the researchers, the spyware delivery mechanism represents a novel technique because it requires no user interaction to execute. When users are shown custom-created advertisements—such as promotions for digital games or telecommunications services—the platform can harvest identifying information and IP addresses. If a user has been selected as a target, mercenary spyware firms can then deploy malicious code to their devices within seconds, all without the user’s knowledge. Citizen Lab states that millions of users worldwide have been served ads through Discover-Tech since 2024, with exposure documented in Yemen, Brazil, Mexico, Czechia, and networks associated with government entities in Europe and the United States, as well as international organisations including the UN, NATO, the International Criminal Court, and the International Atomic Energy Agency.
The researchers indicate that Controlium functions as a facilitator for spyware firms targeting government officials, journalists, businesspeople, activists, academics, and embassy workers. The spyware allegedly can access comprehensive device data, including messages, photos, emails, call recordings, and microphone activation. Citizen Lab researchers have characterised this exploitation of the advertising ecosystem as a systemic security threat affecting states, the private sector, civil society, and individual users.
The findings highlight vulnerabilities in the programmatic advertising market, where automated auctions involving dozens or hundreds of companies determine ad placement based on user profiles compiled through web tracking. Experts note that minimal regulation governs this automated system, creating opportunities for malicious exploitation. The report calls for urgent investigation by cybersecurity agencies, regulators, and lawmakers to address systemic risks enabling malicious ad targeting.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI