Security researchers at The Citizen Lab, a digital rights unit, claim that government spyware makers are misusing global advertising networks to target and hack devices. This is reportedly achieved by serving malicious online adverts.
A report published today by the University of Toronto lab states that an Israeli company, Discover-Tech, enables spyware makers to use its advertising platform to target specific individuals or devices globally with spyware that can invisibly steal data. The researchers suggest Discover-Tech acts as a "bridge between ad vendors and the mercenary spyware ecosystem."
The Citizen Lab identified Candiru and Bindecy, makers of zero-click spyware, as having used Discover-Tech's platform. Zero-click spyware can infect devices without the victim needing to interact with a message or link. The report found that at least 45 Windows computers at Al Jazeera were affected in 2024 and 2025, reportedly hacked via Candiru's spyware after being shown malicious online ads.
While the specific governments behind these attacks are not clear, Citizen Lab stated this marks the first confirmation of zero-click government-backed spyware attacks delivered through online ads. This development could potentially expose numerous devices worldwide to targeting and hacking.
The researchers also found that Discover-Tech's platform, named Controlium, had exposed source code and publicly accessible user login records, including some belonging to employees of Candiru and Bindecy. Billions of ad bidding records were also reportedly exposed, showing ads displayed on devices used by militaries, governments, critical infrastructure, and national cyber agencies between March and June 2026, though it is unclear if these resulted in compromise.