Online ads are being manipulated to install spyware on millions of devices without their owners’ knowledge, with researchers warning that the zero-click malware has compromised a “substantial cluster” of Australian targets including unis and science bodies.

Researchers at the University of Toronto’s Citizen Lab investigated Controlium, an advertising technology platform operated by Israeli firm Discover-Tech, and found it had been profiling online users and enabling spyware operators to deliver malware through targeted advertisements.

The technique, dubbed Candiru AdFection, allows malware to be installed automatically when an infected advertisement is displayed on a vulnerable device, without the user clicking on anything or taking any other action.

By exploiting the vast reach of online advertising networks, the technique has been used in targeted surveillance campaigns, including attacks that compromised at least 45 devices belonging to media organisation Al Jazeera in 2024 and 2025.

Citizen Lab described the system as a “pipeline for spyware”, in an extensive analysis of the malware delivery operation.

Discover-Tech participates in the split-second automated auctions that determine which ads are shown to which users – with researchers identifying more than 718 million ad bids associated with the company.

The profile data shared during the auction – for example, that the user is a 45-year-old Australian female – is fed back to Controlium, which checks the profile against a list of people of interest to determine whether to serve an advertisement containing JavaScript that triggers the malware delivery process.

Citizen Lab said the findings represent the “first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads”.

The researchers said Discover-Tech “presents itself as a legitimate advertising company… but operates as a facilitator for multiple mercenary spyware partners.”

Over a four-month period, its advertisements appeared across nearly 200,000 websites and iOS and Android apps in dozens of countries.

Affected apps ranged from language-learning platform Duolingo and dating services to period trackers, weather apps, Yahoo Mail, Viber and Truecaller.

Websites carrying the advertisements included the CBC, AccuWeather, Fox News, The New York Times, Haaretz and the BBC.

“We have found billions of instances of Discover-Tech bidding to send such advertisements to users,” the researchers said, adding that they had found no evidence the company was engaged in any “legitimate” advertising business activities.

Companies targeted worldwide, including Australia

The campaign reached devices around the world, with Citizen Lab finding Discover-Tech advertisements appearing on devices connected to networks considered sensitive to national security.

These included networks associated with NATO, the United Nations, the European Commission and Nordic critical infrastructure operators.

In Australia, researchers identified a “substantial cluster of impressions” associated with government and private-sector networks in critical infrastructure sectors, including electricity and power companies, universities and research centres.

Media organisations were also targeted, including three Australian outlets and broadcasters in Denmark, France, Mexico, Israel, Italy, Norway and Sweden.

Citizen Lab did not identify most of the Australian victims in its report and had not responded to Information Age requests for further details by publication time.

However, Australia was among 24 countries where government networks were targeted.

Named victims included the Australian Nuclear Science and Technology Organisation (ANSTO) and its Australian Synchrotron research facility.

“ANSTO is aware of the reports, including the reference to its Australian Synchrotron research campus,” an ANSTO spokesperson told Information Age.

The organisation “takes cybersecurity risk management seriously and maintains rigorous security protections across our organisation”.

“We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports.”

Advertising networks expose systemic vulnerabilities

The investigation, supported by separate research from security firm Confiant, has highlighted the vulnerabilities in advertising networks that can distribute malicious content to users who may otherwise take extensive precautions to protect their devices.

“The ad tech supply chain is a path that enables attackers to monetise various scams at scale with the goal of enriching themselves,” Confiant said.

The security firm said Candiru’s malware employed a “cloaking paradigm” similar to techniques used by commercial operators distributing malicious advertisements, but with a level of sophistication beyond typical malvertising.

Such operators exploit digital advertising infrastructure to distribute phishing pages, scams, forced redirects and pop-ups through premium advertising channels, Confiant said.

The findings also highlight the risks associated with an industry that distributes billions of advertisements and generates substantial revenue for major technology companies, including Meta, which has faced scrutiny over its reliance on scam advertising.

Discover-Tech has since been banned from advertising platforms operated by Google and IAB Europe, as well as advertising technology platforms including Beeswax, Vungle and Eskimi.

The investigation also identified a threat actor known as Dark Cartographer using the platform to de-anonymise users at scale, demonstrating how advertising data can be exploited by third parties beyond its intended commercial purpose.

The findings echo concerns about the misuse of tracking pixels, which were the subject of a landmark privacy ruling in June.

“The fact that a ‘certified’ company could target millions of users for years with no signs of legitimate activity,” Citizen Lab warned, “highlights the dangerously inadequate controls over a sector that by its very nature touches almost every individual with a mobile device or a web browser in extremely invasive ways.”