Citizen Lab, the University of Toronto's digital investigations unit, has published technical evidence that an Israeli firm called Discover-Tech has been running a spyware delivery operation disguised as an advertising business. The firm's platform, Controlium, serves seemingly ordinary ads — for games, telecoms services — that silently harvest a user's identity and IP address. If the user is a designated target, a third-party mercenary spyware payload is pushed to their device with zero interaction required. The mechanism exploits the architecture of real-time bidding, the millisecond auction system that powers nearly all online advertising. When a user loads a webpage, their device profile, browsing history, and behavioral data are broadcast to hundreds of bidders simultaneously. Controlium sits inside this flow, using it not to sell products but to fingerprint and locate targets. Millions of users worldwide have been served Discover-Tech ads since 2024, across Yemen, Brazil, Mexico, and Czechia. Corroborating research from Confiant found Discover-Tech's ads reaching networks of European and US government entities, the UN, NATO, the International Criminal Court, and the International Atomic Energy Agency. Citizen Lab says dozens of devices at Al Jazeera were compromised. The targets reportedly include government officials, journalists, businesspeople, activists, academics, and embassy workers. The spyware itself, delivered by unnamed third-party firms facilitated by Controlium, can extract messages, photos, and emails, record calls, and activate microphones — full device access. Citizen Lab researcher Bill Marczak described this as the first concrete technical evidence of a process long theorized: using the ad ecosystem's own profiling infrastructure to identify and automatically hack targets with precision. What makes this structurally significant is that it's not a bug in the ad system — it's the system working exactly as designed, with a different customer. Programmatic advertising was built to identify individuals, profile them in real time, and deliver payloads to their devices with no friction. The only difference between a targeted energy drink ad and a targeted spyware implant is what's in the payload. The infrastructure doesn't distinguish. Citizen Lab researcher Wolfie Christl called it "disastrous" that major ad vendors and organizations failed to detect or prevent these operations for years. The opacity of the ad-tech supply chain — hundreds of intermediaries, no meaningful audit trail, minimal regulation — makes it structurally hospitable to this kind of abuse. Reuters separately reported that billions of dollars in Meta ad revenue comes from scams, illegal gambling, and banned content, while US agencies like ICE have purchased software using ad-tech data to track movements. The researchers are calling on cybersecurity agencies, regulators, and lawmakers in the US and Europe to investigate and address the systemic risks. But the core problem is architectural: the ad ecosystem was optimized for frictionless targeting at scale, and that same optimization makes it a ready-made surveillance pipeline for any actor willing to pay.
