Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
- ID
- 35931
- Status
- summarized
- Published
- 15 Oct 2026, 8:58 PM
- Fetched
- 16 Oct 2026, 10:16 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 16 Oct 2026, 10:17 AM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Citizen Lab at the University of Toronto says Israeli ad agency Discover-Tech has served millions of ads since 2024 through its Controlium platform, which can mass-profile and deanonymize users then silently install zero-click spyware. Dozens of Al Jazeera devices were reportedly compromised, with ads shown in Yemen, Brazil, Mexico, and Czechia; separate research by Confiant says the ads also reached users on networks of European and US government entities, the UN, NATO, the ICC, and the IAEA.
Why it matters
If you run an ad-supported app or embed third-party ad SDKs, this shows that ad delivery can be repurposed as a mass-profiling and zero-click infection channel—Controlium allegedly harvests IP and identity from a benign ad, then hands targets to spyware within seconds. Treat ad tech as untrusted third-party code and weigh whether the revenue justifies exposing your users to that supply chain.
Discussion angle
If you run an ad-supported product, what practical steps would you take to detect or limit this kind of ad-network abuse—and should ad SDKs be treated like any other untrusted dependency?