Online adverts used to plant "zero-click" spyware, researchers say

Online adverts have been used to plant spyware on people's devices without them clicking anything, according to researchers at the University of Toronto.

Citizen Lab, a digital investigations unit at the university, says an Israeli advertising company called Discover-Tech runs a platform called Controlium that lets its clients "mass-profile and deanonymise" internet users and then covertly hack chosen targets with spyware made by other firms.

How it works

According to the researchers, Controlium can collect a person's identity and internet address when they are shown a harmless-looking advert, for example for a game or a phone service. If that person has been selected as a target, a spyware company can then send malicious code to their device.

Unlike most hacking, which relies on someone clicking a link or opening a file, this needs no action at all from the victim. Infections happen within seconds and without the user knowing.

"The online advertising ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware," the report says.

Who was affected

Citizen Lab believes dozens of devices at the Qatari broadcaster Al Jazeera were compromised. Millions of people worldwide have been shown Discover-Tech adverts since 2024, including in Yemen, Brazil, Mexico and Czechia. Separate work by the research group Confiant suggests its ads also reached people on the networks of government bodies in Europe and the US, the UN, Nato, the International Criminal Court and the International Atomic Energy Agency.

The spyware involved can reach everything on a phone, extracting messages, photos and emails, recording calls and secretly switching on microphones. Its targets have included government officials, journalists, business people, activists, academics and embassy staff.

"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a Citizen Lab researcher.

The ad auction problem

When someone visits a website that shows adverts, their details are fed into a split-second auction in which dozens or hundreds of companies bid to show them an ad, based on what is known about their device and their browsing. There is little regulation of this market.

"It's disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company's malicious advertising operations for years," said Wolfie Christl, a researcher working with Citizen Lab. He called on cybersecurity agencies, regulators and lawmakers to investigate.

What you can do

Attacks of this kind are aimed at specific, high-value targets rather than the general public. Security experts still advise keeping phones and browsers updated, which closes the vulnerabilities spyware relies on, and using ad-blocking tools. Apple's Lockdown Mode offers extra protection for people who think they might be targeted.