Imagine you are sitting in a café, scrolling through your favorite news app or a random game on your phone. A banner ad slides across the top of the screen, maybe for shoes, maybe for a travel deal, maybe something you don’t even really notice. You don’t tap it. You don’t click it. You barely look at it. And yet, in that fraction of a second, something sinister could happen. According to a new investigation from Citizen Lab, a team of cybersecurity researchers at the University of Toronto, a shadowy advertising platform called Discover-Tech has been running ads that can be weaponized to secretly profile and even infect devices. The platform, known as Controlium, gives its users the ability to “de-anonymize, fingerprint, and automatically infect devices” the moment an ad appears on screen. This is not a normal malvertising story where clicking a bad link downloads a virus. This is a zero-click attack, meaning the victim does absolutely nothing except look at an ad. The researchers estimate that millions of devices were funneled toward servers operated by Candiru, a controversial spyware company, where those devices could be profiled and potentially targeted for deeper infiltration. It is a chilling reminder that the digital advertising economy, which powers so much of the free internet, is not just annoying or privacy-invasive. It can also be a doorway for state-level espionage.
How does this actually work? To understand, you have to think about how online ads are bought and sold. When you open a website or an app, an automated auction happens in milliseconds. Advertisers bid for the chance to show you something, and their bids are based on all kinds of data about who you are, where you are, and what you’ve been doing online. Discover-Tech inserted malicious script tags into some of the ads it bid on. Those scripts didn’t just deliver a message. They allowed the advertiser to identify your device, create a unique fingerprint, and then send you toward Candiru’s servers, where spyware could be loaded onto your device if the attacker chose to go that far. What makes this even more troubling is how much evidence Citizen Lab found. By analyzing ad-bidding records that were publicly exposed on the Discover-Tech website, researchers were able to see that ads linked to the firm with attacker script tags appeared in more than 70,000 mobile apps and more than 120,000 websites between March and June of this year. Multiple apps displayed more than a million ads connected to Discover-Tech. To put that in perspective, this is not a one-off experiment or a narrow attack against a handful of people. It is a massive, sprawling operation running through the ordinary plumbing of the internet, hidden in plain sight among the countless banners and pop-ups that fill our screens every day.
Of course, not every ad Discover-Tech served was necessarily weaponized. The researchers are careful to say that some of the advertising activity may have been normal, or at least not directly designed to distribute spyware. But the pattern is deeply worrying. Citizen Lab found Discover-Tech ad impressions on government and national-security-linked networks around the world. These include NATO networks and United Nations networks, as well as lawmaking bodies in Europe. They include critical infrastructure providers in Australia, plus armed forces and government agencies in Norway and Sweden. In other words, the people whose devices were being routed toward Candiru’s servers were exactly the kind of people a spyware company’s clients would want to monitor: diplomats, military officials, policy makers, and people who work on sensitive systems that keep countries running. The idea that these individuals might have been targeted through a simple ad in a mobile app or website is almost too easy to believe, and that’s precisely the point. The ad ecosystem is so vast, so fast, and so opaque that malicious actors can hide inside it like fish in the sea. If you are a government trying to spy on someone in another country, you don’t need to break into their phone physically. You don’t need to send them a phishing email and hope they make a mistake. You can just buy ads, wait for them to load, and let the infrastructure do the rest.
Why haven’t we heard more about this kind of thing before? The Citizen Lab researchers offer a simple and sobering explanation: it’s mostly a visibility problem. In the past, when spyware attacks were discovered, they often happened through network logs or forensic analysis of a specific victim’s device. But zero-click ad-based attacks are uniquely hard to catch. Consider the Al Jazeera case, which was a critical clue in this investigation. The network logs from Al Jazeera were key to understanding the ad-based nature of that attack. But as researcher Bill Marczak explains, if a user’s personal device is targeted while they are connected to their home Wi-Fi or mobile data, there is not going to be the same level of network monitoring. There is no corporate security team watching the traffic. There is no sophisticated intrusion detection system logging every connection. It’s just you, your phone, and the invisible data stream flowing through the air. A defender would have to be in the right place at the right time, looking at the right data, to even notice that something strange happened. Most of the time, nobody is watching that closely. And even if they are, the attack is designed to leave little trace. The ad loads, the device is profiled, the spyware is delivered, and then the ad disappears. It’s like a burglar who picks your lock, walks through your house, and then wipes all the fingerprints before closing the door behind them.
This investigation raises profound questions about the trust we place in the digital advertising ecosystem. We often think of ads as annoying but harmless. They track us, they follow us across the internet, they make our phones buzz with things we don’t want. But we rarely consider that the same infrastructure used to serve those ads could be used to serve malicious software to the devices of diplomats, soldiers, and ordinary citizens alike. Jason Kint, CEO of the digital media trade organization Digital Content Next, which represents publishers including WIRED’s parent company Condé Nast, put it plainly when he said that these kinds of attacks are both plausible and damaging. “Although rare and sophisticated, I wouldn’t be entirely surprised to learn about zero-click attacks through ads,” Kint said. “Anything that goes directly against users’ expectations or lowers the trust in the open web is deeply concerning.” That is really the heart of the matter. The open web is built on a bargain: content is free, but users are tracked and shown ads. Most of us accept that bargain because we enjoy the convenience and the access. But when ad networks become a vector for spyware, the bargain becomes toxic. It’s not just about privacy anymore. It’s about personal safety, national security, and the integrity of the information ecosystem.
So what should we take away from this? On one level, the story of Discover-Tech and Candiru is a warning about the dark side of an internet powered by advertising. It reminds us that the seemingly mundane act of loading a webpage can expose us to dangers we cannot see and cannot control. On another level, it is a call for accountability. The digital ad industry has grown so enormous and so powerful that it operates with very little oversight. Ad exchanges, data brokers, and surveillance marketing firms collect and share information about us in ways that are often invisible, even to the companies that own the platforms we use. If an advertising platform can be used to de-anonymize and infect devices, then the entire industry needs to take a hard look at its own practices. Governments and regulators need to demand more transparency. Publishers need to ask more questions about who is buying their ad space and why. And ordinary users need to understand that the threat is not just from phishing emails or suspicious downloads. It can come from a seemingly innocent banner ad, served on a reputable website, in the split second before your eyes move on to the next thing. We are not helpless, but we are not as safe as we thought we were. The internet remains a wonderful, open, creative space. But it is also a battlefield, and the ads we see every day are no longer just distractions. They can be weapons. The challenge now is to find a way to keep the web open without leaving the door unlocked for spies, mercenaries, and everyone else who sees our attention as an opportunity for something much darker.
