This is shocking. It should be making headlines everywhere and lead to urgent corrective action to fix this systemic flaw... Will it, though?
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
November 3, 2026 at 3:39 PM
This is shocking. It should be making headlines everywhere and lead to urgent corrective action to fix this systemic flaw... Will it, though?
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
Zero-click spyware rode in on targeted ads: Candiru delivered via real-time bidding, no tap needed. https://intel.threadlinqs.com/threat/TL-2026-4648?utm_source=bluesky #ThreatIntel #Candiru #DevilsTongue #Controlium
October 28, 2026 at 3:12 PM
Zero-click spyware rode in on targeted ads: Candiru delivered via real-time bidding, no tap needed. https://intel.threadlinqs.com/threat/TL-2026-4648?utm_source=bluesky #ThreatIntel #Candiru #DevilsTongue #Controlium
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say | Hacking | The Guardian
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 27, 2026 at 5:44 PM
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say | Hacking | The Guardian
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
One practical takeaway from the Citizen Lab report: Controlium let customers pick targets by mobile advertising ID. On iPhone, leaving "Allow Apps to Request to Track" off gives apps an all-zeros ID. IP-based targeting still works, though.
October 27, 2026 at 6:39 PM
One practical takeaway from the Citizen Lab report: Controlium let customers pick targets by mobile advertising ID. On iPhone, leaving "Allow Apps to Request to Track" off gives apps an all-zeros ID. IP-based targeting still works, though.
📢 AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur publicitaire légitime, identifiée comme facilitateur de spyware mercenaire via sa plateforme Controlium.
cyberveille.ch
October 28, 2026 at 6:30 PM
📢 AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
📢 AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur publicitaire légitime, identifiée comme facilitateur de spyware mercenaire via sa plateforme Controlium.
cyberveille.ch
October 28, 2026 at 6:30 PM
📢 AdFection : Candiru livre un spyware zero-click via des publicités ciblées contre Al Jazeera
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
Les chercheurs nomment cette technique AdFection. Discover-Tech Ltd (Israël, fondée en 2020) : société se présentant comme un acteur…
🟢 vérification factuelle haute
#AdFection #Candiru #Cyberveille
Worth knowing on iPhone: about 77% of Discover-Tech's bids were for in-app ads, which Safari content blockers don't reach.
With Allow Apps to Request to Track off, apps only see an all-zero ad ID, removing one of the selectors Controlium used to pick targets.
With Allow Apps to Request to Track off, apps only see an all-zero ad ID, removing one of the selectors Controlium used to pick targets.
October 25, 2026 at 9:44 PM
Worth knowing on iPhone: about 77% of Discover-Tech's bids were for in-app ads, which Safari content blockers don't reach.
With Allow Apps to Request to Track off, apps only see an all-zero ad ID, removing one of the selectors Controlium used to pick targets.
With Allow Apps to Request to Track off, apps only see an all-zero ad ID, removing one of the selectors Controlium used to pick targets.
From an Israeli ad firm called Discover-Tech, and their platform called (I'm not making this up) "Controlium".
October 23, 2026 at 1:54 AM
From an Israeli ad firm called Discover-Tech, and their platform called (I'm not making this up) "Controlium".
Ugh. I missed this story.
"Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed"; all that is necessary is for the target to view an ad.
www.theguardian.com/technology/2...
"Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed"; all that is necessary is for the target to view an ad.
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 23, 2026 at 1:54 AM
Ugh. I missed this story.
"Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed"; all that is necessary is for the target to view an ad.
www.theguardian.com/technology/2...
"Unlike infections that rely on people interacting with links or files, the spyware requires no interaction from the victim to be installed"; all that is necessary is for the target to view an ad.
www.theguardian.com/technology/2...
New business idea:
School for wandering minstrels - become the most trusted source of information in the land! Ability to play a lute not essential; hose and doublet provided at enrollment
www.theguardian.com/technology/2...
School for wandering minstrels - become the most trusted source of information in the land! Ability to play a lute not essential; hose and doublet provided at enrollment
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 22, 2026 at 5:10 PM
New business idea:
School for wandering minstrels - become the most trusted source of information in the land! Ability to play a lute not essential; hose and doublet provided at enrollment
www.theguardian.com/technology/2...
School for wandering minstrels - become the most trusted source of information in the land! Ability to play a lute not essential; hose and doublet provided at enrollment
www.theguardian.com/technology/2...
4/ Discover-Tech, an Israeli company, built a system called Controlium. Citizen Lab found it could use advertising identifiers to single out a device and deliver code through an ad. For the chosen target, simply displaying the ad could start a spyware attack. No click needed.
October 19, 2026 at 4:29 PM
4/ Discover-Tech, an Israeli company, built a system called Controlium. Citizen Lab found it could use advertising identifiers to single out a device and deliver code through an ad. For the chosen target, simply displaying the ad could start a spyware attack. No click needed.
This is freakin' serious. "Zero-click," as in, all it has to be is served to your device and you're infected.
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 21, 2026 at 9:46 PM
This is freakin' serious. "Zero-click," as in, all it has to be is served to your device and you're infected.
www.theguardian.com/technology/2...
www.theguardian.com/technology/2...
ad appears on your screen.
You don't click it.
Doesn't matter.
Spyware is already inside your device.
Citizen Lab just published first documented proof.
Called it AdFection.
Israeli ad-tech company "Discover-Tech" ran the operation.
Controlium is their platform.
Here's how it works. 👇🏻
You don't click it.
Doesn't matter.
Spyware is already inside your device.
Citizen Lab just published first documented proof.
Called it AdFection.
Israeli ad-tech company "Discover-Tech" ran the operation.
Controlium is their platform.
Here's how it works. 👇🏻
October 18, 2026 at 4:23 PM
ad appears on your screen.
You don't click it.
Doesn't matter.
Spyware is already inside your device.
Citizen Lab just published first documented proof.
Called it AdFection.
Israeli ad-tech company "Discover-Tech" ran the operation.
Controlium is their platform.
Here's how it works. 👇🏻
You don't click it.
Doesn't matter.
Spyware is already inside your device.
Citizen Lab just published first documented proof.
Called it AdFection.
Israeli ad-tech company "Discover-Tech" ran the operation.
Controlium is their platform.
Here's how it works. 👇🏻
Citizen Lab exposed Discover-Tech, an Israeli firm masquerading as an ad broker while operating Controlium to deliver zero-click malware via programmatic bidding.
October 19, 2026 at 1:41 AM
Citizen Lab exposed Discover-Tech, an Israeli firm masquerading as an ad broker while operating Controlium to deliver zero-click malware via programmatic bidding.
The company was Discover-Tech. It looked like a normal Israeli adtech firm and sat on Google and IAB Europe’s approved vendor lists for years.
Its platform, Controlium, let spyware customers upload lists of targets.
Its platform, Controlium, let spyware customers upload lists of targets.
October 18, 2026 at 4:55 PM
The company was Discover-Tech. It looked like a normal Israeli adtech firm and sat on Google and IAB Europe’s approved vendor lists for years.
Its platform, Controlium, let spyware customers upload lists of targets.
Its platform, Controlium, let spyware customers upload lists of targets.
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
www.theguardian.com/technology/2...
#stem #science #technology #computing
www.theguardian.com/technology/2...
#stem #science #technology #computing
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 18, 2026 at 2:43 PM
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
www.theguardian.com/technology/2...
#stem #science #technology #computing
www.theguardian.com/technology/2...
#stem #science #technology #computing
Social Physics Analysis:
Discover-Tech ran a Smart Selfish Maneuver, hiding behind standard RTB ad exchanges and IAB compliance while operating Controlium as a silent spyware bridge for state intelligence clients.
Discover-Tech ran a Smart Selfish Maneuver, hiding behind standard RTB ad exchanges and IAB compliance while operating Controlium as a silent spyware bridge for state intelligence clients.
October 19, 2026 at 1:42 AM
Social Physics Analysis:
Discover-Tech ran a Smart Selfish Maneuver, hiding behind standard RTB ad exchanges and IAB compliance while operating Controlium as a silent spyware bridge for state intelligence clients.
Discover-Tech ran a Smart Selfish Maneuver, hiding behind standard RTB ad exchanges and IAB compliance while operating Controlium as a silent spyware bridge for state intelligence clients.
Seeing this right after seeing yet another story about ads serving malware.
I'm struck that surveillance targeted ads can't be worth the downsides. Not only are they dangerous, but they *suck* at reaching their intended targets. Otherwise, nobody with any money or power could be online.
I'm struck that surveillance targeted ads can't be worth the downsides. Not only are they dangerous, but they *suck* at reaching their intended targets. Otherwise, nobody with any money or power could be online.
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 19, 2026 at 7:27 PM
Seeing this right after seeing yet another story about ads serving malware.
I'm struck that surveillance targeted ads can't be worth the downsides. Not only are they dangerous, but they *suck* at reaching their intended targets. Otherwise, nobody with any money or power could be online.
I'm struck that surveillance targeted ads can't be worth the downsides. Not only are they dangerous, but they *suck* at reaching their intended targets. Otherwise, nobody with any money or power could be online.
The confirmed target: Al Jazeera. 45 journalist devices were infected between 2024 and 2025.
Controlium had IP addresses and ad IDs matching their staff, served them invisible ads, and those ads delivered invisible spyware.
Controlium had IP addresses and ad IDs matching their staff, served them invisible ads, and those ads delivered invisible spyware.
October 18, 2026 at 4:23 PM
The confirmed target: Al Jazeera. 45 journalist devices were infected between 2024 and 2025.
Controlium had IP addresses and ad IDs matching their staff, served them invisible ads, and those ads delivered invisible spyware.
Controlium had IP addresses and ad IDs matching their staff, served them invisible ads, and those ads delivered invisible spyware.
It's time this nonsense was taken seriously
What have Israel got on politicians worldwide?
Through Pegasus and other online spyware the Israelis are blackmailing our leaders into making decisions which aren't those ordinary ppl approve of
From yesterdays Guardian
www.theguardian.com/technology/2...
What have Israel got on politicians worldwide?
Through Pegasus and other online spyware the Israelis are blackmailing our leaders into making decisions which aren't those ordinary ppl approve of
From yesterdays Guardian
www.theguardian.com/technology/2...
Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
Discover-Tech’s Controlium software lets clients mass-profile internet users then covertly hack targets, say researchers at University of Toronto
www.theguardian.com
October 18, 2026 at 12:06 PM
It's time this nonsense was taken seriously
What have Israel got on politicians worldwide?
Through Pegasus and other online spyware the Israelis are blackmailing our leaders into making decisions which aren't those ordinary ppl approve of
From yesterdays Guardian
www.theguardian.com/technology/2...
What have Israel got on politicians worldwide?
Through Pegasus and other online spyware the Israelis are blackmailing our leaders into making decisions which aren't those ordinary ppl approve of
From yesterdays Guardian
www.theguardian.com/technology/2...
What a New Probe Says and Doesn't Say About an Indian Connection as Online Ads Become Spyware Delivery Channel
thewire.in/world/what-a...
#stem #science #technology #computing #spyware
thewire.in/world/what-a...
#stem #science #technology #computing #spyware
What a New Probe Says and Doesn't Say About an Indian Connection as Online Ads Become Spyware Delivery Channel
An account which was logged in primarily from India was one of several users of ‘Controlium’, a platform operated by Israeli advertising technology company Discover-Tech that allows customers to selec...
thewire.in
October 18, 2026 at 3:17 PM
What a New Probe Says and Doesn't Say About an Indian Connection as Online Ads Become Spyware Delivery Channel
thewire.in/world/what-a...
#stem #science #technology #computing #spyware
thewire.in/world/what-a...
#stem #science #technology #computing #spyware
1. The ad network profiles you using your advertising ID, IP address and cookies.
2. Controlium serves a targeted ad.
3. The moment it renders, no click needed, your device connects to Discover-Tech servers.
4. Those link to Candiru spyware servers. Exploit fires. Spyware installs.
2. Controlium serves a targeted ad.
3. The moment it renders, no click needed, your device connects to Discover-Tech servers.
4. Those link to Candiru spyware servers. Exploit fires. Spyware installs.
October 18, 2026 at 4:23 PM
1. The ad network profiles you using your advertising ID, IP address and cookies.
2. Controlium serves a targeted ad.
3. The moment it renders, no click needed, your device connects to Discover-Tech servers.
4. Those link to Candiru spyware servers. Exploit fires. Spyware installs.
2. Controlium serves a targeted ad.
3. The moment it renders, no click needed, your device connects to Discover-Tech servers.
4. Those link to Candiru spyware servers. Exploit fires. Spyware installs.