Understanding the Issue
Recent investigations by Citizen Lab have linked the Israeli ad company Discover-Tech to a campaign that distributes spyware through targeted advertisements. The so-called "zero-click" method allows malicious code to be installed without any user interaction. For small and medium-size enterprises (SMEs) that rely on digital marketing, understanding this scenario is essential to protect both business data and customer information.
How the Distribution Chain Works
Discover-Tech uses a platform called Controlium, which lets customers select ad targets by mobile ad ID, cookie ID, or IP address. When the ad is rendered on a participating site or app, a piece of JavaScript runs. If that script is malicious, it can download and launch the Candiru spyware, a tool designed to spy on the device without any user click.
Technical steps simplified
- Target selection: the advertiser provides a list of mobile IDs, cookies, or IPs.
- Ad rendering: the ad appears on a website or app.
- Script execution: the embedded JavaScript runs in the browser or app.
- Spyware installation: the script fetches the Candiru payload and starts it in the background.
Real-world impact on devices
The report notes at least 45 Al Jazeera devices were infected between 2024 and 2025. Nearly four billion bidding records across almost 200,000 sites and apps illustrate the potential scale of this technique.
What This Means for SMEs
Small businesses often use third-party ad networks to reach new customers. While most campaigns are legitimate, platforms that allow highly precise targeting increase the chance of exposure to malicious scripts. Even if your company does not create these ads, employees may see them on company or personal devices, creating an entry point for spyware.
Concrete risks
- Credential theft for corporate systems.
- Collection of sensitive customer data, leading to privacy breaches.
- Compromise of devices used for daily operations, reducing productivity.
Practical defence strategies
You don’t need to become a security expert to lower the risk. Here are actionable steps SMEs can take:
1. Restrict device privileges
Ensure company devices cannot install applications or run scripts without admin approval. Use mobile device management (MDM) solutions to enforce these rules.
2. Use browsers with anti-tracking protection
Browsers such as Firefox or Brave block third-party scripts and limit tracking based on cookies and ad IDs.
3. Monitor network traffic
Basic monitoring tools (e.g., firewalls with packet inspection) can flag unusual downloads from suspicious ad domains.
4. Train employees
Teach staff that merely viewing an ad can pose risks. Encourage regular updates of operating systems and applications.
5. Choose transparent ad networks
Prefer platforms that clearly explain their targeting process and enforce strict policies against unverified scripts.
Evaluating new advertising solutions
Before adopting a new ad network or marketing tool, ask yourself:
- How transparent is the targeting and script execution process?
- What review and verification mechanisms are in place for ad content?
- Are there independent security audits or certifications?
Answering these questions helps you select partners that minimise the risk of spyware exposure.
Conclusion
The Discover-Tech case shows that targeted ads can become sophisticated attack vectors. For SMEs, the key is a blend of solid device management, informed choices of advertising partners, and a culture of security awareness. If you would like to discuss how to safeguard your campaigns and devices, feel free to get in touch with us for a tailored consultation.