Security Researchers Uncover Global Spyware Campaign Exploiting Legitimate Advertising Networks

In a discovery that highlights the deepening vulnerabilities of the global digital advertising infrastructure, security researchers have revealed that an Israeli digital advertising firm has been covertly operating as a conduit for sophisticated mercenary spyware. The firm, Discover-Tech, has been identified by researchers at Citizen Lab as the architect behind a massive operation that leveraged its "Controlium" platform to infect mobile devices across the globe. Through a highly advanced technique dubbed "AdFection," the company successfully bypassed traditional security measures to deliver spyware to high-profile targets, including journalists, international diplomats, and government agencies.

The operation marks a significant escalation in the tactics used by the mercenary surveillance industry. Unlike traditional phishing attacks that require a user to click a malicious link or download a suspicious file, the "AdFection" technique relies on "zero-click" exploits. This means that a device can be compromised the moment a malicious advertisement is rendered within an app or a mobile browser, requiring no interaction from the victim. Once the ad is served, Discover-Tech’s platform facilitates the de-anonymization and fingerprinting of the device, followed by the automatic installation of spyware.

The scale of the operation is vast, with the malicious ads appearing in some of the world’s most popular and trusted mobile applications. According to the investigation, apps found to be displaying Discover-Tech’s malicious advertisements include the language-learning platform Duolingo, Yahoo Mail, and the communication app Viber. The reach also extended to more personal and sensitive software, such as dating applications and period-tracking apps, as well as utility-focused software like German weather apps and the caller-identification service Truecaller. The presence of these ads in such a diverse array of consumer software suggests a strategy aimed at broad accessibility, allowing the attackers to cast a wide net before narrowing their focus on specific high-value targets.

Citizen Lab, a research organization based at the University of Toronto’s Munk School of Global Affairs & Public Policy, noted that this is the first documented instance of an in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements. The researchers emphasized that while the advertising industry has long struggled with "malvertising"—where ads lead to malware or scams—the Discover-Tech operation represents a much more dangerous evolution. It effectively weaponizes the very mechanics of the programmatic advertising ecosystem to facilitate state-level or corporate espionage.

The primary victims of this campaign include individuals and organizations involved in high-stakes international affairs and sensitive reporting. Citizen Lab confirmed that the spyware was deployed against dozens of devices belonging to journalists at the Qatari news network Al Jazeera, many of whom were reporting on politically sensitive subjects. Beyond the media sector, the reach of the "AdFection" campaign extended into the heart of global governance and security. Malicious ads were detected appearing within the critical networks used by the United States Pentagon, the United Nations International Atomic Energy Agency (IAEA), and the International Criminal Court (ICC).

The geographic footprint of the campaign was equally expansive. Media organizations and networks in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden were all targeted, alongside various international media services. This global reach underscores the borderless nature of modern digital surveillance and the ease with which a single firm can exploit the interconnected nature of the internet to strike at targets across multiple continents.