An Israeli ad agency has been serving up millions of online advertisements that double as delivery vehicles for spyware. And here’s the kicker – you don’t have to click anything. You don’t even have to touch your screen. Just loading the page is enough. Your phone is one ad away from total surveillance.

Zero-Click Means What It Sounds Like

Researchers at Citizen Lab – that’s the digital investigations unit at the University of Toronto, the ones who always seem to find this stuff – say a company called Discover-Tech has been running what they’re calling a “mass-profile and deanonymise” operation through regular online ads. The kind you scroll past every single day.

Discover-Tech calls itself a specialized digital advertising agency. Which, I mean, that’s technically true in the same way that a burglar is technically a “home entry specialist.”

The software platform they’re using is called Controlium, and it works like this: first, it profiles millions of internet users through these ads. Then, once they’ve identified their targets, they can covertly install third-party spyware without the victim doing anything at all. No clicking a sketchy link. No downloading a suspicious file. Just… infection. In seconds.

Dozens of devices at Al Jazeera, the Qatari broadcaster, got compromised this way, according to the researchers. And look, if you think Al Jazeera was the only target, I’ve got a bridge to sell you.

The Ad Ecosystem Is Completely Broken

Here’s what drives me nuts about this: we’ve all just accepted that the internet is riddled with ads. They track us, they follow us around, they know what we searched for last Tuesday at 2am. Fine, whatever – that’s the devil’s bargain we made for “free” content.

But now the same infrastructure that serves you ads for shoes you looked at once is being weaponized to install actual spyware on your devices. The researchers put it pretty bluntly: “The online advertising ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware.”

Mercenary Spyware, By the Way

That’s the term for spyware that gets sold to whoever’s buying – governments, corporations, whoever. It’s not nation-states building their own tools anymore (well, not just that). It’s a whole industry of companies selling surveillance capabilities to the highest bidder. And apparently, they’re using the online ad system to deliver it.

The thing is, advertising networks were never designed with security in mind. They were designed to be fast, cheap, and everywhere. Mission accomplished on all three fronts. But that also means they’re a gigantic attack surface that most people never think about.

Why Should You Care?

Because you can’t defend against this. Not really.

All the normal security advice – don’t click suspicious links, don’t download files from strangers, use two-factor authentication – that stuff doesn’t apply here. Zero-click means zero-click. You’re just existing on the internet, reading the news or checking the weather or whatever, and boom. Infected.

“The online advertising ecosystem is being weaponised at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware.”

Ad blockers might help, actually. Which is kind of ironic considering how much the advertising industry has spent trying to convince us that ad blocking is basically theft. Turns out blocking ads might also block state-sponsored surveillance. Who knew?

The Bigger Picture Here

This isn’t just about one sketchy Israeli company (though Discover-Tech, if you’re reading this, what the hell?). It’s about how the entire digital advertising infrastructure has become a weapon. These researchers found it this time, but how many other operations are running right now that nobody’s caught yet?

And let’s be real – the ad networks don’t have much incentive to fix this. They make money by showing as many ads as possible to as many people as possible. Thoroughly vetting every advertiser and every piece of ad code? That’s expensive. That’s slow. That cuts into the bottom line.

I’ve been writing about tech long enough to know that “we need better regulation of the ad industry” is not exactly a sexy rallying cry. But honestly, at this point, what’s the alternative? The industry’s had years to police itself and instead we’ve got Israeli firms using banner ads to install spyware on journalists’ phones.

What This Actually Means

If you’re an activist, a journalist, a political dissident, or anyone else who might be on someone’s target list – you’re probably already paranoid about digital security. Good. Stay that way. Maybe get more paranoid, actually.

But here’s what bothers me: the mass profiling part comes first. Controlium has to profile millions of users to identify its targets. Which means all of us are getting swept up in this, even if we’re not the final target. We’re all part of the dragnet so that someone, somewhere, can narrow it down to the people they actually want to hack.

The ad-supported internet was always a compromise. But I don’t remember anyone telling us that part of the deal was participating in mass surveillance operations run by mercenary spyware companies. Feels like that should’ve been in the fine print somewhere.