Citizen Lab Links Discover-Tech Ad Platform to Potential Zero-Click Spyware Attacks

Discover-Tech operates Controlium, an advertising platform that allows users to “de-anonymize, fingerprint, and automatically infect their devices” after they see an ad, according to Citizen Lab researchers. Researchers estimate that millions of devices could be directed to servers operated by Candiru and profiled there.

After analyzing ad-bid records published on the Discover-Tech website, Citizen Lab researchers found that ads linked to the company and containing the attacker’s script tags appeared on more than 70,000 mobile apps and 120,000 websites between March and June of this year. Researchers said multiple apps displayed more than 1 million ads linked to Discover-Tech.

Discover-Tech Ads Appeared on Government and Military Networks

Although the company’s ads did not necessarily use every tool capable of distributing spyware, researchers generally observed Discover-Tech ad impressions on government and national security-related networks around the world. These included networks operated by NATO and the United Nations, European legislative bodies, Australian critical infrastructure providers, and the Norwegian and Swedish militaries and government agencies.

Advertising Infrastructure Can Make Attacks Difficult to Detect

Previous zero-click targeted advertising campaigns distributing spyware rarely surface publicly. Citizen Lab researchers said this is likely a symptom of advertising infrastructure being widely trusted and integrated into nearly every aspect of digital life without special oversight.

“Al Jazeera network logs were key to understanding the ad-based nature of the attack,” Marczak said. “For example, if a user’s personal device is targeted while connected to their home Wi-Fi or mobile data, there won’t be the same level of network monitoring there. So I think the lack of proactive reporting is probably primarily a visibility issue. Defenders need to be in the right place at the right time and see the right data.”

Experts Warn of Zero-Click Attacks Through Digital Ads

Speaking generally about the threats created by the widespread digital advertising ecosystem, Jason Kindt, CEO of Digital Content Next, a digital media industry group that includes WIRED’s parent company Condé Nast, said this type of attack is both plausible and harmful.

“Although rare and sophisticated, I would not be at all surprised to learn about zero-click attacks through advertising,” Kindt said. “Anything that directly contradicts user expectations or undermines trust in the open web is deeply concerning.”