Zero‑Click Spyware Delivered via Targeted Ads: How Discover‑Tech’s Platform Exploits the Ad Ecosystem

The Verge and WIRED both report that an Israeli‑registered ad tech firm, Discover‑Tech, used its advertising platform to deliver zero‑click spyware to at least 45 Al Jazeera devices in 2024‑2025. The attack required no user interaction, showing how the modern ad supply chain can become a silent infection vector.

Zero‑Click Ads: The Mechanics Behind a Silent Infection

A zero‑click attack exploits a vulnerability that lets malicious code run as soon as an ad is rendered, without the user tapping, clicking, or even seeing the creative. In practice, the ad loads a hidden script that triggers a chain of exploits, ultimately installing spyware on the device. Because the user never interacts with the ad, traditional security cues—like a suspicious link or a download prompt—are absent.

Real‑time bidding (RTB) powers most online ads. When you open a page or app, an automated auction runs in milliseconds, matching advertisers with the smallest possible ad slot. RTB collects device identifiers, IP addresses, and sometimes location data to decide which ad to serve. That data collection is what Discover‑Tech leverages: its "Controlium" platform can de‑anonymize a user, fingerprint the device, and then inject a malicious script into the ad response.

Discover‑Tech’s Controlium Platform

Controlium is marketed as a precision‑targeting tool for advertisers, but the investigation shows it also gives spyware operators the ability to:

• Profile and de‑anonymize millions of individuals.
• Fingerprint devices using IP address, mobile ad ID, or browser identifier.
• Select a specific user for infection.

Only WIRED reports that the platform logged more than 70,000 mobile apps and 120,000 websites displaying ads linked to Discover‑Tech between March and June 2024, with over a million ad impressions in some apps. Both outlets agree that the ads were linked to Candiru, an Israeli spyware company blacklisted by the U.S. government (The Verge) and whose assets are now owned by Integrity Partners after 2021 sanctions (WIRED).

Industry Response

The Verge notes that Reuters reported IAB Europe's suspension, while WIRED provides a direct quote from the IAB Europe spokesperson confirming the same.

What This Means for Users and Organizations

The attack chain is entirely invisible to the end‑user, meaning typical defenses—antivirus alerts, phishing warnings, or cautious browsing—offer little protection. The primary mitigations recommended by the researchers are:

• Use reputable ad blockers on browsers and within apps where possible.
• Disable ad‑tracking features on mobile operating systems (e.g., limit ad tracking on iOS and Android).
• Regularly reset mobile advertising IDs, which act as persistent identifiers for ad networks.
• For high‑risk individuals (journalists, activists, corporate executives), consider network‑level ad‑blocking solutions or enterprise‑grade mobile security suites that can inspect TLS‑encrypted traffic for malicious scripts.

Only WIRED highlights that “there isn’t much that people can do to protect themselves other than blocking ads as thoroughly as possible,” emphasizing the limited personal agency against this supply‑chain abuse.

Analysis: The Unseen Threat and What to Watch

The trade‑off here is between the ad ecosystem’s personalization benefits and the exposure it creates to covert exploitation. Real‑time bidding enables advertisers to serve highly relevant ads, but the same data pipelines give malicious actors a scalpel‑precise way to inject code. In practice, this means that every app or website that participates in RTB becomes a potential delivery route for spyware, even if the publisher’s own content is benign.

Who gains?

• Spyware vendors like Candiru gain a cheap, automated distribution channel that bypasses traditional security checks.
• Governments or hostile actors that fund such vendors can target dissidents or journalists at scale.

Who loses?

• End users who are unaware that an ad they never saw may have compromised their device.
• Publishers and app developers who may be unwitting carriers, risking reputation and potential legal liability.

What to watch next?

1. Policy changes at major ad exchanges – If Google, Meta, or Amazon introduce stricter vetting for ad suppliers, the attack surface could shrink.
2. Ad‑tech transparency standards – Emerging initiatives like the IAB’s “Transparency & Consent Framework” may evolve to require cryptographic signing of ad creatives, making hidden scripts harder to inject.
3. Device‑level mitigations – Future OS updates could sandbox ad rendering processes more aggressively, similar to how browsers isolate third‑party content.
4. Legal actions – Sanctions against companies like Candiru may expand, potentially forcing ad platforms to adopt zero‑tolerance policies more uniformly.

For now, the safest bet for most users is to minimize exposure to the ad supply chain: block ads wherever feasible, keep devices updated, and stay alert for any unexpected behavior (battery drain, data spikes, unknown apps). Organizations should audit their mobile app stacks for ad SDKs and consider moving to ad‑free enterprise solutions for high‑risk teams.

Practical Steps You Can Take Today

1. Install a reputable ad blocker such as uBlock Origin on desktop browsers and use ad‑blocking browsers like Brave on mobile.
2. Turn off “Limit Ad Tracking” on iOS (Settings → Privacy → Tracking) and Android (Settings → Google → Ads → Opt out of Ads Personalization).
3. Reset your advertising ID at least once a month (iOS: Settings → Privacy → Apple Advertising Support; Android: Settings → Google → Ads → Reset Advertising ID).
4. Review installed apps for unnecessary ad SDKs; uninstall or replace apps that heavily rely on ad revenue if they handle sensitive data.
5. Stay informed – Follow reputable security blogs for updates on ad‑tech threats and patch releases for your device’s OS.

By reducing the number of ads your device processes, you shrink the attack surface that platforms like Discover‑Tech exploit.

Sources

• The Verge – An Israeli firm is sending spyware through online ads, researchers say
• WIRED – ‘Nightmare Scenario’: Zero‑Click Spyware Is Infecting Phones via Targeted Ads