According to the report, Controlium is able to harvest a user’s identity and IP address when the user is shown a seemingly benign custom-created ad – for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say.

They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia.

Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.

“It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.”