Citizen Lab, a research unit at the University of Toronto, has identified what it describes as a weaponized online advertising operation run by Discover-Tech, an Israeli digital advertising agency. The organization operates a platform called Controlium that allegedly enables clients to profile and deanonymize internet users before covertly deploying third-party spyware against selected targets.
The spyware delivery mechanism represents a novel threat vector, according to Citizen Lab. Unlike traditional malware distribution methods that require users to click on links or download files, the identified spyware installs without any user interaction or awareness. The researchers indicate that infection occurs silently and within seconds of a user being shown a customized advertisement. The ads themselves appear benign, promoting products such as digital games or telecommunications services.
Citizen Lab reports that Discover-Tech has served ads to millions of users globally since 2024, with exposure documented in Yemen, Brazil, Mexico and Czechia. Separate research by Confiant suggests the advertising network has also reached users at government entities in Europe and the US, as well as international organizations including the UN, NATO, the International Criminal Court and the International Atomic Energy Agency. According to Citizen Lab’s analysis, Controlium facilitates attacks targeting government officials, journalists, business executives, activists, academics and embassy workers.
The identified spyware capabilities include access to device messages, photos and emails, call recording and covert microphone activation. Citizen Lab researchers note that the scale of exploitation and the length of time the operation remained undetected represent significant gaps in advertising ecosystem security. The findings add to existing concerns about how programmatic advertising auctions—in which automated bidding occurs across dozens or hundreds of companies in milliseconds—can be exploited for surveillance and malicious purposes. Discover-Tech has been contacted for comment on the allegations.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI