An Israeli firm is sending zero-click spyware through online ads
Article URL: https://www.theverge.com/tech/1011956/discover-tech-zero-click-ads-spyware Comments URL: https://news.ycombinator.com/item?id=50106676 Points: 245 # Comments: 13
An Israeli advertising technology firm collaborated with spyware companies to deploy zero-click malware via targeted online advertisements, according to a joint investigation by Citizen Lab and Confiant. This marks the first documented instance of a zero-click attack delivered through online ads. The ad firm, Discover-Tech, masquerades as a conventional online advertising agency but functions as a conduit for hacking groups to disseminate malicious ads across the internet.
It operates Controlium, a platform enabling its spyware partners to profile and de-anonymize millions of individuals, identify their devices, and precisely target them for zero-click hacking. Candiru, another Israeli spyware company blacklisted by the US government, is among Discover-Tech's clients. In 2024 and 2025, the partnership delivered Candiru-linked spyware to Al Jazeera, a Qatari news network, targeting "at least" 45 devices.
The security researchers urge the advertising industry to bolster platform security. Both Google and the Comcast-owned advertising firm Beeswax have since removed Discover-Tech from their platforms, while IAB Europe has suspended the company from its list of approved vendors. Researchers also advise high-risk users to employ ad blockers, disable ad tracking, and routinely reset mobile ad IDs.
Written by urgent.news from Hacker News Best's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.