Israeli firm's digital ads enabling installation of 'zero-click' spyware

https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say

75•chunkyslink•37m ago

Comments

fergie•25m ago

How does this actually work? Are they talking about browser fingerprinting or something else?

reactordev•22m ago

If I had to ponder a guess…

It’s to do with hiding malware/spyware in an image which ends up in your cache on device. I can’t go much further into details but all this takes is for you to visit a site that serves it via ad network.

Israel has been known to have some sneaky spyware in the past with Pegasus.

room606•21m ago

https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zer...

https://citizenlab.ca/research/how-discover-tech-turned-targ...

beel•20m ago

Here is a better article https://citizenlab.ca/research/how-discover-tech-turned-targ...

andunie•16m ago

Looks like it's much worse, they get more information due to exploits, and they can take full control of your machine.

Article on the CitizenLab website: https://citizenlab.ca/research/how-discover-tech-turned-targ...

pelagicAustral•15m ago

There is a tinfoil narrative that suggest that entire formats are in bed with intelligence services. It sounds pretty wild, but other zero-click attack vectors have been possible through sabotaging the parsing of file formats. ie. send a message -> hacked. How? the message wasnt even opened. How is, an app like Messenger receives a photo attachment binary, tries to unpack it and in doing so receives an instruction that stops the parser and executes arbitrary instructions.

donutdonot•4m ago

With all the AI decompilation going on would it not be possible to find these things in the binary by now?

andunie•25m ago

Do ad blockers protect against this?

Lio•18m ago

> Reuters has reported that billions of dollars’ worth of Meta’s ad revenue comes from ads for scams, illegal gambling, pornography and other banned content. In the US, ICE and other government agencies have bought software that uses ad tech data to track people’s movements.

I don't know if an ad blocker protects against Discover-Tech’s Controlium but in general you'd be a fool to allow ads in your browser in at this point. The ad industry is pretty shady all round.

andunie•22m ago

Turns out Google killing Android privacy was completely useless as a way to prevent people from being hacked, but they might use this type of stuff to justify even more closing of supposedly "free" paltforms.

Likewise, using privacy messengers like Signal is also useless if they can just take control of your entire device anytime they want.

user43928•5m ago

I'm sure Google's latest push to make it inconvenient to install apps from outside Google's Playstore, where Google charges a 30% commission, is going to solve that.

amelius•17m ago

It's fun to see adtech digging a hole for themselves ...

classified•12m ago

If only! I think we can no longer afford to ignore all these security threats and should make online advertising wholesale illegal. But I won't hold my breath.

iugtmkbdfil834•13m ago

Looking at the bright side, we might just be able to make people really dislike ads.

throw0101c•6m ago

Actual report from Citizen Lab:

* https://citizenlab.ca/research/how-discover-tech-turned-targ...