Israeli ad company helped a spyware firm target Al Jazeera through online ads, researchers say
- Israeli ad firm DiscoverTech allegedly smuggled zero-click spyware from Candiru onto ~200,000 sites, snagging 45 Al Jazeera devices.
- Researchers call it the first public proof that the shady ad-buying machine can be weaponized to infect phones with no clicks or downloads.
- The victims just had to load a page and gawk at an ad; no tap, no file, no consent—just a silent data heist.
- DiscoverTech's 'Controlium' program let operators hunt targets via ad IDs, browser fingerprints, and IP addresses, then serve malware like a promo code.
- Ad industry giants Google, IAB Europe, and others finally yanked the plug after the report—after years of enabling the circus.
Brief Summary
Hold onto your browsers, because the internet's most annoying feature—online ads—just got a promotion to 'cyberattack delivery vehicle.' Citizen Lab and ad-security firm Confiant dropped a report proving Israeli ad vendor DiscoverTech ran a secret side hustle called Controlium, letting spyware maker Candiru inject zero-click malware into Al Jazeera staffers' devices via the same ad networks that plaster every page you visit. It's the first smoking-gun evidence that the trillion-dollar programmatic ad industry can be hijacked to infect people without so much as a click, reaching nearly 200,000 websites and apps, including government portals. The hacks hit in 2024 and 2025, and the researchers reconstructed the carnage from Al Jazeera's network logs—because of course the news outlet was the target, given that spyware's favorite hobby is silencing journalists. DiscoverTech's site brags about 'fraud-free traffic,' which is either a gutsy lie or a typo for 'fraud-free for us, malware-free for you.'
Why This Matters
Here's your wake-up call, and it's buzzing with malevolent banner ads: blocking ads isn't just about dodging annoying pop-ups or saving your data plan—it's now a personal cyber-defense tactic. Researchers flat-out say ad-blocking should be a 'cybersecurity best practice,' yet they admit it's not bulletproof, so you're basically expected to play whack-a-mole with invisible assassins. The bigger gut-punch is that major ad platforms, including Google, didn't catch this until researchers spoon-fed them the evidence, then scrambled to ban DiscoverTech. That means the industry's 'quality control' is about as effective as a screen door on a submarine, and your only real move is to reset your ad ID, disable tracking, and pray the next zero-click exploit isn't hiding in a car insurance commercial. For the average reader, this isn't a tech niche story; it's a brutal reminder that every scroll through the web is a roll of the dice, and the house—marketing's chaotic middlemen—has been playing you for a fool while charging you with your data.