Israelis spied on ordinary online ads: are Slovenes also targeted?

An Israeli company has allegedly used online advertisements to covertly infiltrate users' devices, according to research conducted by the Citizen Lab at the University of Toronto and the cybersecurity firm Confiant. The investigation uncovered that software developed by the Israeli firm Discover-Tech enables mass profiling of internet users and hidden infiltration into targeted devices. According to the findings, a device can become infected with malicious code within seconds, even without user interaction. The research revealed how online ads could be exploited for mass data collection and covert infiltration into users' devices. Software named Controlium, developed by Discover-Tech, allows for mass profiling of internet users and subsequent covert infiltration into targeted devices. As reported by the British Guardian, the Israeli company, which presents itself as a digital advertising agency, displayed millions of ads online through which devices could be infected with malware without users clicking on them or taking any other action. These attacks are referred to as "zero-click" attacks, meaning they occur without user engagement. According to the findings of the Citizen Lab, the Controlium software can obtain information about a user's identity and IP address upon displaying specially prepared ads that appear harmless at first glance. If a user is selected as a target, the entity offering the malware can send malicious code to their device and infect it, reports the Guardian. Researchers found that Discover-Tech’s ads were shown to over a million users worldwide since 2024, including in Yemen, Brazil, Mexico, and the Czech Republic. A related study by Confiant showed that Discover-Tech’s ads were also shown to users in networks of government agencies in Europe and the United States, as well as in the networks of the United Nations, NATO, the International Criminal Court, and the International Atomic Energy Agency. According to the Citizen Lab, Controlium operates as a platform for other companies offering malware. These entities have reportedly targeted government officials, journalists, businesspeople, activists, academics, and embassy staff, notes the Guardian. Researchers warn that malware installed through such attacks can gain access to all data on a device, including messages, photos, emails, recording phone calls, and activating microphones without the user's knowledge. The full extent of the alleged surveillance enabled by the Discover-Tech platform is currently unknown. The findings of the Citizen Lab represent new evidence that online advertising systems can also be exploited for espionage. Why are online ads useful for espionage? When a user visits a website with ads, an automatic auction takes place in the background, involving dozens or even hundreds of companies competing to show their ad to the user, writes the Guardian. These offers are based on the user profile, which can include information about their device and data collected from their online activity. For example, companies receiving a profile of a 35-year-old interested in sports betting and cryptocurrencies might offer an ad for energy drinks. This system allows companies to precisely target ads while creating opportunities for abuse, warns the Guardian. According to researchers, this automated advertising market is poorly regulated, and increasing evidence shows that its mechanisms are being exploited by malicious actors. The ads from Discover-Tech were displayed through different advertising partners between March and June 2026 on more than 120,000 websites and in over 70,000 mobile applications. Often, they advertised completely ordinary products, such as phones and wireless earbuds, so users had no obvious reason to suspect anything was wrong. Researchers found that the company could identify users and track their online activities. In some cases, it attempted to obtain phone numbers of smartphone users. Collecting certain data required nothing more than loading the ad on a webpage or app. Users did not need to click on it. According to co-founder of Confiant, Jerome Dangu, Discover-Tech displayed at least ten million ads daily around the world. Malware without a click The most concerning findings relate to the connections between Discover-Tech and providers of malware. According to researchers, the advertising infrastructure was also used to assist in installing malicious software on targeted devices. Such attacks could be carried out without clicking on an ad or any other direct action by the user. In cyber security, this type of attack is known as a zero-click attack. Citizen Lab reported that malware from the Israeli company Candiru infected 45 Windows-based devices in the media organization Al Jazeera between 2024 and 2025. Researchers confirmed these infections through analysis of network logs provided by the television network. This does not mean that every user who saw a Discover-Tech ad was infected or targeted. Researchers caution that merely displaying an ad does not prove a device was infected. It means that the advertising infrastructure could be used for covert data collection and in some cases for attacks. Ads reached networks of important institutions According to researcher findings, Discover-Tech’s ads were also displayed in networks of institutions where data security is particularly important. Among them were the United Nations, NATO, the European Commission, and various national and defense agencies. Confiant also warned about ads appearing in the networks of the International Atomic Energy Agency and the International Criminal Court. Researchers found that the advertising infrastructure could enable data collection about user activities even in such environments. Palestinian territories appeared to be especially exposed, where Discover-Tech’s ads supposedly appeared frequently. However, the mere presence of ads in the network of a particular institution does not mean its systems were infected with malware. Google removed the company from its platforms Following the publication of the findings, advertising platforms began withdrawing from the company. Google removed Discover-Tech’s access to its advertising systems due to systematic violations of rules. Other providers also took action, including Comcast’s advertising platform Beeswax, while Vungle, operating under the LiftOff company, temporarily suspended access to the company during verification. The European Digital Advertising Association IAB Europe removed the company from the list of approved providers.