Citizen Lab at the University of Toronto has published what amounts to the first concrete technical evidence of a long-feared attack vector: programmatic online advertising repurposed as a spyware delivery pipeline. The Israeli firm Discover-Tech, operating a platform called Controlium, allegedly served millions of ads since 2024 that harvest user identity and IP data, then deliver zero-click mercenary spyware to selected targets — no link-clicking, no file-opening, no interaction at all. The mechanism exploits the structural reality of real-time bidding. Every time a user loads a page with ads, their device profile, location, and behavioural data are broadcast to hundreds of companies in a split-second auction. Controlium allegedly sits inside this auction as an ad buyer, using the profiling infrastructure to "mass-profile and deanonymise" internet users, then delivering malicious payloads disguised as ad content to pre-selected targets. The infection happens in seconds, silently. The target list is not hypothetical. Citizen Lab identified compromised devices at Al Jazeera, the Qatari broadcaster. Corroborating research from Confiant found Discover-Tech ads served on networks belonging to European and US government entities, the UN, NATO, the International Criminal Court, and the IAEA. Millions of users in Yemen, Brazil, Mexico, and Czechia were served Discover-Tech ads. The full scope of targeting remains unknown. Controlium acts as a facilitator for third-party mercenary spyware firms. Once installed, the spyware can extract messages, photos, and emails, record calls, and secretly activate device microphones. Citizen Lab says targets include government officials, journalists, businesspeople, activists, academics, and embassy workers — the same profile that has appeared in NSO Group's Pegasus scandals and similar operations. The deeper structural problem is that none of this required breaking the ad ecosystem's rules. The real-time bidding system was designed to profile users and deliver content to their devices at scale and speed. Discover-Tech allegedly just used it for its logical endpoint. Major ad vendors and the organisations whose networks were compromised apparently failed to detect or prevent the operations for years, as Citizen Lab researcher Wolfie Christl noted. This is not the first evidence that ad tech infrastructure enables surveillance — US agencies including ICE have purchased software using ad data to track movements, and Reuters has documented billions in Meta ad revenue from scams and banned content — but it is the first documented case of the full chain: mass profiling through ads, target selection, and zero-click spyware delivery through the same pipe. The distinction between advertising infrastructure and intelligence infrastructure has effectively collapsed. Citizen Lab and Confiant are calling for urgent intervention from cybersecurity agencies, regulators, and lawmakers. The systemic risk is not one rogue firm — it is that the programmatic advertising ecosystem, by design, creates the exact profiling and delivery capabilities that spyware operators need. The question is whether any regulator is prepared to treat ad tech as the attack surface it demonstrably is.
