An Israeli advertising firm has delivered spyware to millions of phones around the world without users knowing, researchers said Thursday.

An Israeli advertising firm has delivered spyware to millions of phones around the world without users knowing, researchers from the University of Toronto said Thursday. File Photo by Sascha Steinbach/EPA UPI

Oct. 15 (UPI) -- An Israeli advertising firm has delivered spyware to millions of phones around the world without users knowing, researchers from the University of Toronto said Thursday.

Discover-Tech, an Israeli ad agency, has allegedly been using a software called Controlium that allows it to infect mobile devices with no-click spyware, meaning users do not need to interact with the advertisements to be hacked.

Citizen Lab, the digital investigations research lab at the University of Toronto, said Controlium allows the Israeli firm to "mass-profile and deanonymize" internet users without their knowledge and extract their data, including their identity and IP address.

"This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads," Citizen Lab's report says.

The advertisements pose as average personalized ad content based on a user's online activity.

Third-party spyware firms have been using Discover-Tech's software platform "for years," researchers say.

"It's disastrous that major ad vendors and organizations apparently were neither able to detect nor prevent the company's malicious advertising operation for years," said Wolfie Christl, Citizen Lab researcher. "The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike."

Citizen Lab said that it believes 45 devices used by Al Jazeera journalists and staff were targeted, and some infected, by spyware that used Discover-Tech's platform to be delivered.

The research team said the "malicious advertisements were purchased by Discover-Tech." The team analyzed 4 billion Discover-Tech bidding records, finding that its ads appeared on nearly 200,000 unique websites on both Android and iOS devices across dozens of countries.

Citizen Labs submitted its findings to ad vendors and industry organizations. Some companies, including Google, IAB Europe, Beeswax, Vungle and Eskimi took action to disconnect Discover-Tech's access to advertising with them.