Researchers say Israeli ad technology enabled spyware targeting Al Jazeera devices
Researchers at Citizen Lab say an Israeli advertising firm’s software has enabled clients to identify internet users and deliver spyware through ordinary online adverts. They allege the system was used to compromise dozens of devices at Al Jazeera, highlighting how the digital advertising industry could be exploited for covert surveillance.
Citizen Lab says Discover-Tech’s Controlium platform can collect users’ identities and IP addresses when they see tailored adverts, then help third-party spyware firms target selected devices without any action by the user. Millions of people in countries including Yemen, Brazil, Mexico and Czechia have reportedly been served the firm’s adverts since 2024; related research found them on networks used by government bodies and international organisations. The researchers say the spyware can access messages, photos and emails, record calls and activate microphones, though the full extent of alleged targeting remains unknown.
- Researchers say ads enabled zero-click spyware attacks.
- Dozens of Al Jazeera devices were allegedly compromised.
- Millions saw the firm’s adverts since 2024.
New here? Start with this
Online adverts are usually delivered through systems that match them to users, based on information such as their location or browsing activity. Citizen Lab says Discover-Tech, an Israeli advertising firm, developed a platform called Controlium that could use adverts to identify people and help spyware operators select devices to target.
Spyware is software that can secretly monitor a device, potentially accessing messages, photos and emails or activating its microphone. Al Jazeera is a news organisation whose staff and contacts may handle sensitive information, so alleged targeting of its devices raises questions about the risks of using advertising systems for surveillance.
The researchers say adverts linked to the platform have appeared in several countries and on networks used by public bodies and international organisations. The scale and full effects of the alleged targeting are not known.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
If the researchers’ account is accurate, using routine adverts to identify and compromise people’s devices is a serious intrusion into privacy and security, especially when it can expose private messages, calls and recordings without users’ knowledge. The alleged targeting of journalists and devices at a news organisation raises particular concerns about press freedom and the safety of sources, and supports calls for scrutiny of the firms and clients involved.
The case against
The allegations are serious but the full extent of the targeting and the roles of the advertising firm, its clients and any spyware providers remain unclear; conclusions about responsibility should therefore await fuller evidence and responses from those involved. Targeted surveillance can be defended in some circumstances as a tool against serious threats, provided it is authorised, necessary, proportionate and subject to independent oversight, rather than deployed indiscriminately or against journalists for their reporting.
Business Cybersecurity Middle East Research Science Software Technology World
Read the full article at the source →
Originally published by The Guardian as “Israeli firm’s digital ads enabling installation of ‘zero-click’ spyware, researchers say”.