A Citizen Lab investigation shows an Israeli ad-tech company used programmatic advertising on Google, Facebook and other platforms to deliver zero-click malware to Al Jazeera journalists and other targets.
A Citizen Lab investigation exposed an Israeli company called Discover-Tech. Dressed as an ad-tech firm, it operated as a mercenary spyware dealer.
Ad slots became an attack surface
Google, Facebook and their peers assign every user an ID and allow advertisers to serve code against those IDs. An ad is just a blob of code, which gave attackers an opening.
Discover-Tech checked billions of ad auctions against its list of targets and served malicious ads to anyone who matched. Victims only had to load a page or open an app to get their device taken over—no clicks, no warning.
Al Jazeera staff were among the victims, attacked by another Israeli spyware vendor called Candiru.
An industry-issued safety certificate
More absurdly, Discover-Tech held safety certifications from Google, Microsoft, Yandex, Comcast's Beeswax and IAB, the ad-tech trade body.
It even used fake GDPR pop-ups as bait, letting users think they could opt out of commercial surveillance.
The problem is not advertising but surveillance. Targeted ads improve click-through rates by less than 5% over content-based ads, yet they expose every user's identity and location to the worst bidders.
The real answer is to ban surveillance advertising entirely and return to context-based ads. Until then, the only self-defence is to block all programmatic ads.
Why it matters
This puts the bill for the 'free internet' in front of everyone: every page you load or app you open can become a way for someone to attack you. Security becomes a luxury you must either build yourself by blocking ads or simply hope for.
Curated from high-quality sources, with concise summaries and key takeaways.
