Zero-click spyware ads silently infected millions since 2024

In a surprising and troubling finding, researchers say an Israeli advertising agency was used to deliver spyware through online ads without any user interaction. The researchers describe a platform called Controlium that lets clients mass-profile people and then covertly hack targets using third-party spyware. In other words, you could be exposed to a weaponized ad that secretly compromises your device just by loading a page with an advertisement.

The claims come from Citizen Lab, a digital investigations unit at the University of Toronto, and Confiant. They say the operation has served ads to millions of users since 2024, including in places like Yemen, Brazil, Mexico and Czechia. The targeted infections are what security researchers call zero-click attacks: the spyware installs itself without the user opening a link, reading a file, or taking any action.

The spyware pipeline is described as a facilitator rather than a single product. Controlium is said to allow third-party spyware firms to fingerprint a device, tailor a malicious ad to a specific user profile, and then push a payload to the target. In practice, that could mean a target in a government, media, business or academic environment is quietly compromised just by viewing an ad that seems harmless.

What makes this especially worrying is the scope and the money behind the ads. Researchers say the ecosystem that powers online advertising already pools data from billions of profiles. If a bad actor can tap into that system, they can both identify high-value targets and quietly plant spyware at scale. Wolfie Christl from Citizen Lab called the arrangement a security threat that spans governments, the private sector and civil society.

There is no public, government-wide consensus on how to regulate this level of ad-tech abuse yet. Some watchers point to the big platforms that cut deals with advertisers as a weakness in the system, while others say tighter controls on data sharing and more transparent ad tech partnerships are essential. For now, Discover-Tech, the agency described in the investigation, has been approached for comment, and some ad networks have already said they removed Discover-Tech from their platforms.

What does this mean for you? If you’re worried about becoming a target or simply want to reduce risk, you’re not alone. The researchers’ recommendations include using ad blockers, turning off ad tracking in your devices, and regularly resetting mobile identifiers used by advertisers. These steps won’t eliminate the risk, but they can reduce how uniquely you are profiled and how precisely an attacker might target you.

On the policy side, experts say the ad ecosystem needs stronger security standards and better mechanisms to detect and stop suspicious campaigns before they can scale. Regulators and technology companies may need to decide how to balance free online advertising with safeguards against covert spyware delivery.

In short, the ad you see could be more than just a distraction. It could be a doorway to a stealthy intrusion, without ever clicking a thing. That’s why the conversation about online ads and user privacy is moving from vague warnings to concrete, enforceable protections.

What happens next? Expect ongoing scrutiny of ad-tech platforms, more disclosures about how ads are delivered, and likely updates to browser and mobile defaults that make covert infections harder to pull off. For everyday users, it means staying vigilant about ad behavior, updating devices regularly, and applying basic privacy tools that reduce how much information advertisers can collect about you.