An Israeli firm is sending zero-click spyware through online ads