An Israeli ad company, DiscoverTech, has for years been secretly helping spyware developers place their hacking software on popular websites, researchers at Citizen Lab say, resulting in a cyberattack that targeted at least 45 devices at the news outlet Al Jazeera. The findings, documented in a report published Thursday by Citizen Lab, are the first time cybersecurity experts have shown how online ad platforms, so common across the internet that they are inescapable, can be used as a vector to hack visitors’ devices without their knowledge.

“Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” said Natalia Krapiva, a spyware expert at the digital rights nonprofit Access Now, who read the report and was not involved with its research. “States and tech companies whose infrastructure is used to conduct these attacks need to take urgent technical, legal and regulatory measures.”

The report is a joint effort between Confiant, a U.S. ad security company, and the Citizen Lab, a University of Toronto operation that researches mercenary spyware computer programs. Spyware is often leased to governments around the world to help them hack devices of people they want to spy on. While spyware companies often tout their products as crucial tools for governments to enforce national security, the tech has repeatedly been used around the world to crack down on journalists, human rights advocates and political opposition.

DiscoverTech is a Tel Aviv company that sells online advertising services, the report said. “We take pride in providing our clients with a gateway to global fraud-free traffic, connecting your brand with real users,” its site says. DiscoverTech is one of a number of companies that help brands show their s on websites that may be visited by potential customers.

But the company secretly ran a separate program, the report says, that allowed spyware companies to inject malicious software onto visitors’ devices. The malicious code used to hack Al Jazeera computers was particularly effective, the researchers said, because it was “no-click” spyware — meaning a victim did not need to download a file or even click a link to be infected, just visit a website with a vulnerable computer and see the ad.

The hacks, which were not previously reported until the release of the Citizen Lab’s report, occurred in 2024 and 2025. Al Jazeera provided the Citizen Lab with network logs from the period of the attacks, which researchers used to reconstruct how they unfolded, the Citizen Lab said in the report. It previously reported that the phones of 36 Al Jazeera journalists and staff members had been hacked with what it said was Pegasus spyware made by a different Israeli company, NSO Group, most likely by operators linked to Saudi Arabia and the United Arab Emirates.

NSO said at the time that it would review the findings. Al Jazeera did not respond to a request for comment. Neither did DiscoverTech and its CEO. Like many advertising platforms, DiscoverTech has a wide reach: The report said it serves ads on almost 200,000 websites, Android apps and iOS apps, including those of major media organizations, search engines, government agencies and dating services. The report says Confiant detected DiscoverTech ads served on networks of major government entities like those of the U.S. Defense Department and the Dutch Economic Affairs Ministry, though it emphasized that the presence of ads does not indicate those organizations were targeted in malicious campaigns.

Five ad vendors and industry organizations responded to the Citizen Lab’s findings by disconnecting DiscoverTech from their platforms.

A Google spokesperson told NBC News that Google had helped the Citizen Lab and Confiant in their investigation and affirmed their findings, saying DiscoverTech is now banned on Google Ads. A spokesperson for IAB Europe, the continent’s largest trade organization for the advertising industry, said it has suspended DiscoverTech from its platforms. The report said the ad platforms Beeswax, Vungle and Eskimi took similar action. The online advertising industry is a vast, convoluted and largely unregulated system that relies on maintaining significant technical information about people.

Websites rarely directly control which companies post ads on their sites. Instead, advertisers preprogram “bids” for every person who visits and often prefer to advertise to people matching certain characteristics so their ads can be more targeted. The industry usually refrains from collecting specific personal information on people, but it assigns them industry “advertising IDs” and ties information like age, sex, location and preferences to them. The researchers say DiscoverTech taps into that system to offer a secret program called Controlium, which allows spyware companies to use DiscoverTech’s ad network to identify people to hack and help them deliver the malicious code to take over their devices.

Controlium is not mentioned on DiscoverTech’s website, but researchers say they found source code on its pages and were able to view aspects of how the program works. It allowed users to pick specific people to infect or profile using their phones’ advertising IDs, browser identifiers or IP addresses, numbers assigned to internet connections that can help tie people to locations such as their homes. The researchers found that Candiru, an Israeli spyware company that now operates as Integrity Labs, used DiscoverTech’s ads to deliver its spyware.

The U.S. Commerce Department added Candiru to its Entity List in 2021, saying foreign governments had used its software to target journalists, activists and government officials. Wolfie Christl, one of the Citizen Lab researchers behind the report, said it illustrates something cybersecurity experts have long warned about: that the murky online advertising industry can be a vector for hackers to target victims and that most people should consider ad blocking software to be an essential cybersecurity tool. But even that is not foolproof, he said.

“I think that our findings confirm once again that ad blocking must be considered a cybersecurity best practice. However, as ad blockers often try to balance protection and usability, they might still not consistently protect from malicious ads and other malicious code,” Christl said. “We recommend resetting or disabling the so-called Advertising ID on mobile devices and using opt-out features of apps. Generally, it’s difficult, if not almost impossible, to consistently protect yourself from malicious ads,” he said.