Slashdot has reported:

Citizen Lab says it has documented the first publicly confirmed case of mercenary spyware delivered through targeted online ads without any action by the victim. The digital investigations research unit at the University of Toronto calls the technique “AdFection” and believes dozens of devices at Qatari broadcaster Al Jazeera were compromised through ads run by Discover-Tech, a company that describes itself as a specialised digital advertising agency.

Bill Marczak, a Citizen Lab researcher, said: “There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action.” Unlike attacks that depend on a person opening a link or file, this method can install spyware without the target interacting with the ad. Citizen Lab says infections occur without the user’s knowledge and can take seconds.

Discover-Tech operates Controlium, a software platform that Citizen Lab says lets clients “mass-profile and deanonymize” internet users before covertly hacking selected targets with third-party spyware. The report says the online advertising ecosystem is “being weaponized at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware.”

According to the researchers, Controlium can collect a user’s identity and IP address when that person is shown a seemingly harmless, custom-made ad, such as one promoting a digital game or telecommunications service. If the user is selected for hacking, a mercenary spyware firm can then send malicious code containing spyware to the device. The target does not need to click the ad or otherwise interact with it for the infection to occur.

Since 2024, millions of users worldwide have been served ads by Discover-Tech, the report says, including people in Yemen, Brazil, Mexico and Czechia. The full extent of the targeting allegedly enabled by the company is unknown. Citizen Lab’s findings add to evidence that opaque arrangements in online advertising can be used for surveillance.