The Citizen Lab researchers say that Discover-Tech operates an advertising platform, Controlium, that can allow its users to “de-anonymize, fingerprint, and automatically infect devices” once an ad appears. Overall, the researchers estimate that millions of devices were directed to Candiru’s servers, where they could be profiled. By analyzing ad-bidding records that were publicly exposed on the Discover-Tech website, the Citizen Lab researchers say, ads linked to the firm with attacker script tags were shown in more than 70,000 mobile apps and more than 120,000 websites between March and June this year. Multiple apps, the researchers say, displayed more than a million ads linked to Discover-Tech.

The firm’s ads weren’t necessarily all weaponized to potentially distribute spyware, but the researchers say that, in general, they have seen Discover-Tech ad impressions on government and national-security-linked networks around the world. These include NATO and United Nations networks, as well as lawmaking bodies in Europe, critical infrastructure providers in Australia, plus armed forces and government agencies in Norway and Sweden.

Previous zero-click targeted ad campaigns that distribute spyware have rarely surfaced publicly, but the Citizen Lab researchers say this is likely a symptom of ad infrastructure being so extensively trusted and incorporated in all aspects of digital life without specific oversight.

“The network logs from Al Jazeera were key in understanding the ad-based nature of that attack,” Marczak says. “If a user’s personal device were targeted, say, while they were connected to their home Wi-Fi or mobile data, there’s not going to be the same level of network monitoring there. So I think the lack of prior reporting is probably mainly a visibility issue: Defenders have to be in the right place at the right time, looking at the right data.”

Speaking generally about threats that can result from the sheer ubiquity of the digital ad ecosystem, Jason Kint, CEO of the digital media trade organization Digital Content Next (WIRED parent company Condé Nast is a member), says these kinds of attacks are both plausible and damaging.

“Although rare and sophisticated, I wouldn’t be entirely surprised to learn about zero-click attacks through ads,” Kint says. “Anything that goes directly against users’ expectations or lowers the trust in the open web is deeply concerning.”